An XCCDF Rule
pam_faillock.so
/etc/pam.d/password-auth
/etc/pam.d/system-auth
unlock_time=<interval-in-seconds>
interval-in-seconds
authselect
authconfig
unlock_time
0
faillock