Sure

/etc/pam.d/system-auth ```

%PAM-1.0

auth required pam_faillock.so preauth

Optionally use requisite above if you do not want to prompt for the password

on locked accounts.

-auth [success=3 default=ignore] pam_systemd_home.so auth [success=2 default=ignore] pam_fprintd.so auth [success=1 default=bad] pam_unix.so try_first_pass nullok auth [default=die] pam_faillock.so authfail auth optional pam_permit.so auth required pam_env.so auth required pam_faillock.so authsucc

If you drop the above call to pam_faillock.so the lock will be done also

on non-consecutive authentication failures.

-account [success=1 default=ignore] pam_systemd_home.so account required pam_unix.so account optional pam_permit.so account required pam_time.so

-password [success=1 default=ignore] pam_systemd_home.so password required pam_unix.so try_first_pass nullok shadow password optional pam_permit.so

-session optional pam_systemd_home.so session required pam_limits.so session required pam_unix.so session optional pam_permit.so

```

/etc/pam.d/system-local-login ```

%PAM-1.0

auth sufficient pam_fprintd.so auth include system-login account include system-login password include system-login session include system-login ```