Hi,
I was curious if someone could point me toward the reasoning behind why these remediation scripts are using /etc/pam.d/system-auth and /etc/pam.d/password-auth? It seems like the man page for pam_faillock directs the usage to /etc/pam.d/login instead.