In pam_sm_authenticate of pam_tally.. It calls tally_bump(). and tally_bump() has following codes. if (no_magic_root || getuid()) { tally += inc; ..... } getuid() always return '0', because login is owned by root(0), I think. So, pam_tally cannot increment tally value in authentication step and dosen't work correctly. so, i modified it. use 'uid' variable instead of 'getuid()' function. uid is returned by pam_get_uid(); after above modification, pam_tally work correctly. pam_sm_acct_mgmt has same problem.. Am I wrong? -- ----------------- Junyoung Heo (ÇãÁØ¿µ)