{{{ oval_metadata("The number of allowed failed logins should be set correctly.") }}}
^\s*auth.*pam_unix\.so
^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc
^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$
^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)
^[\s]*fail_interval[\s]*=[\s]*([0-9]+)
/etc/pam.d/common-auth
1
/etc/pam.d/common-auth
1
/etc/pam.d/common-account
1
/etc/pam.d/comon-auth
1
/etc/security/faillock.conf
1