re-add debian tally config

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/templates/etc/login.defs.j2

@@ -30,7 +30,7 @@ MAIL_DIR          {{ os_useradd_mail_dir }}
 CREATE_HOME       {{ 'yes' if os_useradd_create_home else 'no' }}
 
 {% endif %}
-# Enable logging and display of `/var/log/faillog` login failure info.
+# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
 FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.

roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2

@@ -0,0 +1,13 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: tally2 lockout after failed attempts enforcement
+Default: yes
+Priority: 1024
+Conflicts: cracklib
+Auth-Type: Primary
+Auth-Initial:
+  required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
+Account-Type: Primary
+Account-Initial:
+  required      pam_tally2.so