I'm a fan of pam_shield, because it's tied right to the auth part versus tailing log files. And you can trigger whatever action you want. I believe the defaul

I'm a fan of pam_shield, because it's tied right to the auth part versus tailing log files. And you can trigger whatever action you want. I believe the default is just null routing. https://github.com/jtniehof/pam_shield https://github.com/jtniehof/pam_shield There are other, similar pam modules if this one isn't your cup of tea. There's pam_tally2, and others.