faillog tips — authorized failure-log literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run faillog on the lab host (syllabus box you own or were given access to; root/sudo as authorized).
2. Prefer documenting who / why / ticket before any reset (-r) — never poke production lockouts without change control.
3. Record short factual notes; quote short Evidence (username, failure count — never passwords or full PII dumps).
4. Optional: PAM peer → faillock-tips.
5. Optional: lastlog peer → lastlog-tips.
6. Prefer disposable lab accounts for faillog drills; quote failure-count labels afterward as Evidence.
7. Prefer read-only listing for most Evidence binders unless the syllabus asks for a reset drill.
8. Stop at literacy — no attack or unauthorized lockout-bypass cookbooks.

Allowed framing

• Classroom labs reviewing faillog on authorized disposable accounts.
• Binding short factual notes as Evidence (user/failure-count — no secrets).
• Documenting expected vs observed failure counts for authorized inventory notes.
• Comparing faillog ↔ faillock / lastlog / lastb peer tip pages under one binder.
• Testing reset modes only when the syllabus authorizes that drill on lab accounts.

Scope we will not cover

• No crack/pirate/keygen via faillog.
• No intentional unauthorized lockout resets against foreign hosts.
• No secret-theft or credential harvesting via failure-log PII on hosts you do not own.
• No cookbooks that weaken PAM lockout policy for unauthorized access.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with a usable failure-log database.
2. Prefer a throwaway lab account before any reset drill.
3. With authorization, run faillog (list mode as syllabus directs); quote non-secret username/failure-count labels as Evidence.
4. Optional: PAM peer with faillock-tips; lastlog peer with lastlog-tips.
5. Stop at literacy — no attack or unauthorized lockout cookbooks.

Practical notes for authorized labs

• faillog reads a failure-log database distinct from PAM faillock tally — keep Evidence labels distinct from faillock-tips.
• Failure records may embed usernames/hosts — redact PII before notes leave the lab.
• Pair with lastb-tips / login-tips when those tools are the friendlier front-ends for related Evidence.
• Prefer documenting username/count labels the syllabus authorized without dumping full remote-host lists.
• Never commit failure-log dumps with PII to git — even for labs.
• Label lab-only failure drills clearly so they are not mistaken for production incident response.

FAQ-aligned refusals (quick)

• Foreign-host faillog dump / reset → refuse.
• Unauthorized PAM-weaken / lockout-bypass cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources