title: pam_tally2 tallying successful logins as failures
body: <p>I am editing my /etc/pam.d/common-auth file in debian to the following: </p>
  
  <pre><code>auth    [success=1 default=ignore]      pam_unix.so nullok_secure
  auth    requisite                       pam_deny.so
  auth    required                        pam_permit.so
  auth    [success=1 default=ignore]      pam_succeed_if.so user = linuxuser
  auth    required                        pam_tally2.so file=/var/log/faillog onerr=fail deny=3 unlock_time=30
  account required                        pam_tally2.so
  </code></pre>
  
  <p>so I can enable account lockouts for failed password attempts. When testing with the account <code>user</code>, it tallies both successful and unsuccessful logins</p>
  
  <p>In my research I found two suggestions. </p>
  
  <p>1) Add <code>account required            pam_tally2.so</code> to /etc/pam.d/common-account</p>
  
  <p>2) Make sure /etc/ssh/sshd_config had <code>ChallengeResponseAuthentication no</code> instead of <code>ChallengeResponseAuthentication yes</code></p>
  
  <p>I have made both of these changes, and am still having this problem. I also tried rearranging the lines so that it looked like the following: </p>
  
  <pre><code>auth    [success=1 default=ignore]      pam_succeed_if.so user = linuxuser
  auth    required                        pam_tally2.so file=/var/log/faillog onerr=fail deny=3 unlock_time=30
  account required                        pam_tally2.so
  auth    [success=1 default=ignore]      pam_unix.so nullok_secure
  auth    requisite                       pam_deny.so
  auth    required                        pam_permit.so
  </code></pre>
  
  <p>But this did not work either. Anyone know what I'm doing wrong? </p>
  
  <p>Edit: I have now noticed that when logging in as <code>user</code> the tally is incremented before the password is entered and does not get reset if the correct password is entered. I now have the pam_tally2 rules placed about pam_unix.so and the <code>account required     pam_tally2.so</code> in both the common-auth and common-account files.  HELP!</p>