block user account after failed password

hi guys

I have Centos 5.4

The idea is lock the user account for 3 minutes after he has entered his password incorrectly 3 times.

I've modified /etc/pam.d/system-auth

auth        required      pam_tally.so onerr=fail per_user deny=3
account     required      pam_tally.so reset

besides the code above I used these 2 commands to get things working

Set lock out at 3 failed login attempts:
faillog -m 3
Exclude root from this lockout mechanism:
faillog -u root -m 0

as you see I have not defined the lock_time=180 yet since no matter where I put it up there it won't work

where should it be? in order that after 3 or more failed attempts and after wait 3 minutes user can log to the system since for instance he now remember his correct password

Now I can unblock his account manually by faillog -r -u username but I want to avoid that admin task

thanks a lot

From the man page of pam_tally

In my interpretation (tho I'm not sure) this means that lock_time will block access for a certain time after each failed attempt, which would be useful to slow down a brute-force attack. unlock_time, however, sets the time until an account is automatically unlocked after the maximum number of tries.

One side note -

You do not want accounts like oracle, root, or other major resource owners accounts locked on a production system. If you have people hacking accounts on a production system you should consider other approaches - than lockout.

thanks for the info

the point is

auth        required      pam_tally.so onerr=fail per_user deny=3 lock_time=180

or 
account     required      pam_tally.so reset lock_time=180

it won't work

no matter where I put lock_time=180 either line what I want does not work

---------- Post updated at 04:07 PM ---------- Previous update was at 04:02 PM ----------

interesting what you say what other approaches you think I should use or you are using?

thanks