# {{ ansible_managed }}
-D
-b 8192

-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock -p wa -k logins

-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity

-w /home/{{ breakglass_username }} -p rwxa -k breakglass-usage

-e 2