I'm not familiar with pam_shield but I've used the pam_faillock module (which is similar to pam_tally2) for years and it just works(TM) [0]. In fact, here, it'

I'm not familiar with pam_shield but I've used the pam_faillock module (which is similar to pam_tally2) for years and it just works(TM) [0]. In fact, here, it's automatically configured on each and every host at install-time (via the post-installation scripts in my kickstart files). I can't remember a time when I ever needed to "touch" it afterwards. (A few years ago, I evaluated pam_tally2 vs. pam_faillock and settled on pam_faillock but, unfortunately, I can't recall what led me to that choice.) --- [0]: In reality, though, it doesn't really do much. There's only two Internet-facing servers with 22/TCP open to the world -- the bastion hosts -- and only public-key authentication is permitted on those.