---
- name: Set password complexity
  lineinfile:
    path: /etc/security/pwquality.conf
    regexp: '^minlen'
    line: 'minlen = 14'

- name: Lock out after 5 failed login attempts
  lineinfile:
    path: /etc/pam.d/common-auth
    line: 'auth required pam_tally2.so deny=5 onerr=fail unlock_time=900'
    create: yes