Replace pam_tally2 with pam_faillock in Redhat

[martinbydefault]

Redhat security guide recommends the use of pam_faillock to configure account lockout policy.

Currently the PAM module used in the role to configure account lockout is pam_tally2
https://github.com/dev-sec/ansible-os-hardening/blob/ac9fbb312a41fa91fa18da48e700bae6ae97328a/tasks/pam.yml#L112-L119
https://github.com/dev-sec/ansible-os-hardening/blob/ac9fbb312a41fa91fa18da48e700bae6ae97328a/templates/etc/pam.d/rhel_system_auth.j2#L5-L13

I would like to suggest to switch to use faillock for Redhat.
I can provide a PR with the needed changes, based in configuration examples from the redhat guide.

Also there there are 2 other open issues related to this: #194 #252 that I could try to solve in the changes.

[rndmh3ro]

After reading some time about pam_faillock, it seems to be the successor to pam_tally and pam_tally2.

I can provide a PR with the needed changes, based in configuration examples from the redhat guide.

This sounds good!

Also there there are 2 other open issues related to this: #194 #252 that I could try to solve in the changes.

If you can separate these changes in different commits, I'm fine with this.

[schurzi]

we have now switched to pam_faillock