Bug 2209073

Description of problem:

Reading the rule description, from STIG official webpage https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2022-12-06/finding/V-230334:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Note: This check applies to RHEL versions 8.0 and 8.1, if the system is RHEL version 8.2 or newer, this check is not applicable.
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The above text seems to infer that the rule "accounts_passwords_pam_faillock_interval" should not apply to RHEL8.2 and later.

But scanning for STIG on a 8.6 or later system shows the rule executes.

Please tell us if it's a rule bug or if it's more the checks listed to confirm compliance that do not apply to RHEL8.2 or later:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ sudo grep pam_faillock.so /etc/pam.d/password-auth

auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0
auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0
account required pam_faillock.so

If the "fail_interval" option is not set to "900" or less (but not "0") on the "preauth" lines with the "pam_faillock.so" module, or is missing from this line, this is a finding.

$ sudo grep pam_faillock.so /etc/pam.d/system-auth
...
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

scap-security-guide

How reproducible:

Always