faillock (lockout after failed logins)

The PAM module pam_faillock: it counts a user's failed logins and after deny failures in a row refuses even the right password until unlock_time passes. faillock --user shows the counter, faillock --reset clears it.