remove pam_tally2

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/templates/etc/login.defs.j2

@@ -30,7 +30,7 @@ MAIL_DIR          {{ os_useradd_mail_dir }}
 CREATE_HOME       {{ 'yes' if os_useradd_create_home else 'no' }}
 
 {% endif %}
-# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
+# Enable logging and display of `/var/log/faillog` login failure info.
 FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2

@@ -3,7 +3,6 @@
 
 #%PAM-1.0
 {% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_env.so
 auth        sufficient    pam_unix.so nullok try_first_pass
@@ -11,7 +10,6 @@ auth        requisite     pam_succeed_if.so uid >= 500 quiet
 auth        required      pam_deny.so
 
 {% if os_auth_retries > 0 %}
-account     required      pam_tally2.so
 {% endif %}
 account     required      pam_unix.so
 account     sufficient    pam_localuser.so

roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2

@@ -1,13 +0,0 @@
-{{ ansible_managed | comment }}
-# Generated by Ansible role {{ ansible_role_name }}
-
-Name: tally2 lockout after failed attempts enforcement
-Default: yes
-Priority: 1024
-Conflicts: cracklib
-Auth-Type: Primary
-Auth-Initial:
-  required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
-Account-Type: Primary
-Account-Initial:
-  required      pam_tally2.so