Enable audit logging for failed logon attempts

Description

The audit option in /etc/security/faillock.conf must be enabled so that username information is logged when unsuccessful logon attempts occur.

Rationale

Without auditing of failed logon attempts, it is difficult to detect brute-force attacks or unauthorized access attempts. The audit option causes pam_faillock to send information about failed attempts to the audit log.

Framework references

Live verification