# {{ ansible_managed }}

{% if faillock.matched >= 1 %}
auth required pam_faillock.so preauth
auth [success=1 default=ignore] pam_unix.so
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc
{% else %}
auth [success=1 default=ignore] pam_unix.so
auth required pam_tally2.so onerr=fail audit silent deny=3 unlock_time=900
{% endif %}
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so