controls:
    -   id: SRG-OS-000021-GPOS-00005
        levels:
            - medium
        title: {{{ full_name }}} must enforce the limit of three consecutive invalid
            logon attempts by a user during a 15-minute time period.
        rules:
            - var_accounts_passwords_pam_faillock_deny=3
            - var_accounts_passwords_pam_faillock_fail_interval=900
            - var_accounts_passwords_pam_faillock_unlock_time=never
            - accounts_passwords_pam_faillock_audit
            - accounts_passwords_pam_faillock_deny
            - accounts_passwords_pam_faillock_deny_root
            - accounts_passwords_pam_faillock_dir
            - accounts_passwords_pam_faillock_interval
            - accounts_passwords_pam_faillock_unlock_time
            - account_password_selinux_faillock_dir
            - account_password_pam_faillock_system_auth
            - account_password_pam_faillock_password_auth
            - audit_rules_login_events_faillock
        status: automated
