add rhel faillock config

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2

@@ -2,14 +2,19 @@
 # Generated by Ansible role {{ ansible_role_name }}
 
 #%PAM-1.0
-{% if os_auth_retries > 0 %}
-{% endif %}
 auth        required      pam_env.so
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
 auth        sufficient    pam_unix.so nullok try_first_pass
+{% if os_auth_retries > 0 %}
+auth        [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
 auth        requisite     pam_succeed_if.so uid >= 500 quiet
 auth        required      pam_deny.so
 
 {% if os_auth_retries > 0 %}
+account     required      pam_faillock.so
 {% endif %}
 account     required      pam_unix.so
 account     sufficient    pam_localuser.so