<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("The unlock time after number of failed logins should be set correctly.", rule_title=rule_title) }}}
    <criteria operator="AND" comment="Checks common to both scenarios">
      <criterion test_ref="test_accounts_passwords_pam_tally2_unlock_time"
      comment="Verify unlock time configuration of pam_tally2 in common-auth" />
      <criterion test_ref="test_accounts_passwords_pam_tally2_unlock_time_account"
      comment="Verify unlock time configuration of pam_tally2 in common-account" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_accounts_passwords_pam_tally2_unlock_time"
  check="all" check_existence="all_exist"
  comment="Verify unlock_time configuration of pam_tally2" version="1">
    <ind:object object_ref="object_accounts_passwords_pam_tally2_unlock_time" />
    <ind:state state_ref="state_accounts_passwords_pam_tally2_unlock_time" />
  </ind:textfilecontent54_test>
  <external_variable id="var_accounts_passwords_pam_tally2_unlock_time" datatype="int"
                     comment="number of failed login attempts allowed" version="1"/>

  <ind:textfilecontent54_object id="object_accounts_passwords_pam_tally2_unlock_time"
    comment="Check unlock_time configuration of pam_tally2" version="1">
    <ind:filepath>/etc/pam.d/login</ind:filepath>
    <ind:pattern operation="pattern match">^\s*auth\s+required\s+pam_tally2\.so\s+[^\n]*unlock_time=([0-9]+)[\s+\S+]*\s*\\*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_accounts_passwords_pam_tally2_unlock_time" version="1">
    <ind:subexpression datatype="int" operation="greater than or equal"
      var_ref="var_accounts_passwords_pam_tally2_unlock_time"/>
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_test id="test_accounts_passwords_pam_tally2_unlock_time_account"
  check="all" check_existence="all_exist"
  comment="Verify  configuration of pam_tally2_account" version="1">
    <ind:object object_ref="object_accounts_passwords_pam_tally2_unlock_time_account" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_accounts_passwords_pam_tally2_unlock_time_account" comment="Check account configuration of pam_tally2" version="1">
    <ind:filepath>/etc/pam.d/common-account</ind:filepath>
    <ind:pattern operation="pattern match">^\s*account(?:(?!\n)\s)+required(?:(?!\n)\s)+pam_tally2.so(\s|$)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
