SSH pam faillock - using only pub/priv keys

UNIX for Beginners Q & A
1

Hi,

I have an Oracle Linux system which only facilitates pub/priv SSH key pairs for SSH login access.
Username/password credential authentication over SSH is disabled by default.
i.e. 'PasswordAuthentication no' within the sshd_config.

I have been trying so far unsuccessfully to get this in place...
Q - Is it feasible to incorporate PAM faillock counters for SSH access in (*On a system only for pub/priv keys)?

/etc/pam.d/system-auth
auth   required      pam_faillock.so preauth silent audit deny=3 unlock_time=1200
auth   [default=die] pam_faillock.so authfail audit deny=3 unlock_time=600

Or does the AUTH pam module not even come into play without username/password submission?

Regards
R

2

should they [also] be in /etc/pam.d/sshd config ?