The pam_faillock module (and its older counterpart, pam_tally2) tracks the number of consecutive failed authentication attempts for a user account and can automatically lock the account after a configured threshold is reached, helping to mitigate brute-force password guessing attacks.
Administrators can configure the number of allowed attempts, the lockout duration, and whether the lockout applies even to the root account. This differs from password expiration, which is handled by fields in /etc/shadow and related PAM modules.