Ensure account lockout after 3 failed logons (RHEL 8.0-8.1 pam.d form)

minor=$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID#*.}")
case "$minor" in
  ''|*[!0-9]*) minor=99 ;;
esac
if [ "$minor" -ge 2 ] 2>/dev/null; then
  echo "NOT APPLICABLE: RHEL 8.$minor uses /etc/security/faillock.conf (see pam-faillock-deny)"
  exit 0
fi
for f in /etc/pam.d/system-auth /etc/pam.d/password-auth; do
  if ! grep -qE '^\s*auth\s+.*pam_faillock\.so.*preauth' "$f" 2>/dev/null; then
    echo "FAIL: $f missing pam_faillock preauth line"; exit 1
  fi
  if ! grep -qE '^\s*auth\s+.*pam_faillock\.so.*(deny=[1-3])(\s|$)' "$f" 2>/dev/null; then
    echo "FAIL: $f pam_faillock deny not set to 3 or less"; exit 1
  fi
done
echo "OK: pam_faillock deny<=3 configured in pam.d"
exit 0

expected_exit:

0

note:

On RHEL 8.0-8.1 add pam_faillock preauth/authfail/account lines with deny=3 to /etc/pam.d/system-auth and /etc/pam.d/password-auth.