Verify that Ubuntu 22.04 LTS utilizes the "pam_faillock" module by using the following command: $ grep faillock /etc/pam.d/common-auth auth [default=die] pam_faillock.so authfail auth sufficient pam_faillock.so authsucc If the "pam_faillock.so" module is not present in the "/etc/pam.d/common-auth" file, this is a finding. Verify the "pam_faillock" module is configured to use the following options: $ sudo grep -Ew 'silent|audit|deny|fail_interval|unlock_time' /etc/security/faillock.conf audit silent deny = 3 fail_interval = 900 unlock_time = 0 If "audit" is commented out, or is missing, this is a finding. If "silent" is commented out, or is missing, this is a finding. If "deny" is set to a value greater than "3", is commented out, or is missing, this is a finding. If "fail_interval" is set to a value greater than "900", is commented out, or is missing, this is a finding. If "unlock_time" is not set to "0", is commented out, or is missing, this is a finding.