You can disable account for bad users...

Then you can write simple rule and put under /etc/pam.d

The following example, disable account after 3 unsuccessful login

Put the following directive under /etc/pam.d/system-auth



time authconfig is run.

auth required pam_env.so

auth required pam_tally.so per_user deny=3

auth sufficient pam_unix.so nullok try_first_pass

auth requisite pam_succeed_if.so uid >= 500 quiet

auth required pam_deny.so

account required pam_unix.so

account sufficient pam_succeed_if.so uid < 500 quiet

account required pam_permit.so

password required pam_cracklib.so try_first_pass retry=3

password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok

password required pam_deny.so

session optional pam_keyinit.so revoke

session required pam_limits.so

session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session required pam_unix.so

Yes, you can script around this or look at PAM settings:

Lock account:

passwd -l userName

Unlock account:

passwd -u userName