[sudo-users] Re: sudo and faillog

[Todd C. Miller]

> I'm guessing it is related in some way to ipam_acct_mgmt() and
> pam_tally but I really don't know.  Unfortunately, the PAM docs
> don't shed any light on the problem.

It looks like this could even be a pam config problem.  If pam_tally
is listed for sudo in the auth section but not the account section
then the counter would get incremented like you are seeing.
 
 - todd