> auth required pam_faillock.so preauth silent deny=3 unlock_time=never fail_interval=900 I have seen other security theater types suggest this. What a complet

> auth required pam_faillock.so preauth silent deny=3 unlock_time=never fail_interval=900 I have seen other security theater types suggest this. What a completely stupid idea. If an attacker or even a well meaning script triggers this on the account you have sudo with you are now locked out forever. Using fail2ban with a temp ban is enough to stop brute force attempts.