Ensure pam_faillock module is enabled

grep -qE '^\s*auth\s+required\s+pam_faillock\.so' /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null || {
  echo "FAIL: pam_faillock not in PAM config"
  exit 1
}
dir=$(grep -E '^\s*dir\s*=' /etc/security/faillock.conf 2>/dev/null |
  awk -F= '{print $2}' | tr -d ' ')
if [ -z "$dir" ]; then dir="/var/run/faillock"; fi
case "$dir" in
  /var/log/*|/var/lib/*|/etc/*) echo "OK: faillock enabled, dir=$dir (persistent)"; exit 0 ;;
  /var/run/*|/run/*|/tmp/*) echo "FAIL: faillock dir=$dir (not persistent)"; exit 1 ;;
  *) echo "OK: faillock enabled, dir=$dir"; exit 0 ;;
esac

expected_exit:

0

service:

system-auth

module:

pam_faillock.so

type:

auth

control:

required

args:

preauth silent