I am having an impossible time setting up the hosts to lock accounts after X bad login attempts. It will lock the accounts out from su but not from the gui (gnome) login screen. Any help would be much appreciated.

Using kernel 2.4.27 due to our software developer.

I have tried modding common-*, login, /etc/login.defs and everything else in /etc/pam.d

Every answer google comes up with is the same thing, add two lines to common-auth and create the var/log/faillog file and turn on faillogging. Well that doesn't work for the gui, only for su.