Unable to implement Account lockout policy
I'm trying to Implement some account lockout policy on our Linux systems using the STIG standard and also implement 2fa with duo. However, I am not getting the desired result.
Firstly, when i enter the wrong password, push notifications still get sent to my device which is not supposed to be.
Secondly, When i do 6 intentional wrong logins within 15 minutes, the account is supposed to get locked but that's not the case. I am able to login and on successful login, I'm informed that there were 6 failed login attempts since last successful login.
How can i get fix this.
Here is my /etc/ssh/sshd_config file content