# Begin /etc/pam.d/system-auth
# pam_faillock.so preauth: check lock state BEFORE pam_unix attempt.
# Locked accounts deny immediately; preauth on its own does not increment.
auth      required      pam_faillock.so preauth silent
# pam_unix.so sufficient: success short-circuits; failure falls through.
auth      sufficient    pam_unix.so try_first_pass
# pam_faillock.so authfail [default=die]: on pam_unix failure, increment
# the fail counter and exit with PAM_AUTH_ERR. Required for the lock to
# trip after `deny` failures.
auth      [default=die] pam_faillock.so authfail
# pam_faillock.so authsucc: on successful auth, reset the fail counter.
auth      sufficient    pam_faillock.so authsucc
# Catch-all deny.
auth      required      pam_deny.so
# End /etc/pam.d/system-auth
