Description of problem:
pam_tally2 is being utilized to deny access after 'x' attempts to sudo with an incorrect password.

Version-Release number of selected component (if applicable):
1.7.2-p2

How reproducible:
Very

Steps to Reproduce:
1. edit /etc/pam.d/system-auth and add the line "auth required pam_tally2 deny=5"
2. run 'pam_tally2 -u <user_name>' (it should be 0)
3. as another user that is allowed to sudo to <user_name> attempt to sudo and supply an incorrect password 'sudo <user_name>'
4. repeat step 3 two more time (that would make 3 attempts)
5. as the user in step 3 use sudo and supply the correct password
6. as <user_name> run 'pam_tally2 -u <user_name>'
  
Actual results:
the counter should be at 3

Expected results:
the counter should have reset to 0 upon successful login

Additional info:

According to the pam_tally2 documentation:
<snip>
ACCOUNT OPTIONS

    Account phase resets attempts counter if the user is not magic root. This
    phase can be used optionally for services which don't call pam_setcred(3)
    correctly or if the reset should be done regardless of the failure of the
    account phase of other modules.
</snip>

Looking at the source code for sudo, we find this in sudo-1.7.2p2/auth/pam.c:

<snip>
/*
     * Set credentials (may include resource limits, device
ownership, etc).
     * We don't check the return value here because in Linux-PAM
0.75
     * it returns the last saved return code, not the return code
     * for the setcred module.  Because we haven't called
pam_authenticate(),
     * this is not set and so pam_setcred() returns PAM_PERM_DENIED.
     * We can't call pam_acct_mgmt() with Linux-PAM for a similar
reason. */
    (void) pam_setcred(pamh, PAM_ESTABLISH_CRED);
</snip>

As the comment states, pam_authenticate hasn't been called and as the
man page for pam_setcred states:

<snip>
 It should be called to set the credentials after a user has been
 authenticated and before a session is opened for the user (with
 pam_open_session(3)).
</snip>

To work around this issue you have to add pam_tally2 to the account section "account required pam_tally2.so" for the counter to reset to 0.