# /etc/security/faillock.conf — pam_faillock configuration
# InterGenOS T0-4-B PAM-side closure (operator-greenlit RHEL 9 baseline 2026-05-19).
# Source-of-truth for faillock rate-limiting parameters.

# Lock account after this many consecutive failed authentication attempts.
deny = 5

# Auto-unlock after this many seconds.
unlock_time = 900

# Apply the rate-limit to root as well as regular users.
# Without this, root brute-force is rate-limit-exempt at the PAM layer.
even_deny_root

# Record lock state in this directory.
dir = /var/run/faillock
