# {{ ansible_managed }}

account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
account requisite     pam_deny.so
account required      pam_permit.so
{% if faillock.matched >= 1 %}
account required     pam_faillock.so
{% else %}
account required      pam_tally2.so
{% endif %}