Linux PAM rule "pam_unix.so" module above "pam_faillock"

Question

I would like to know what this below PAM rule

auth [success=1 default=bad] pam_unix.so

above the pam_faillock.so rule is doing

auth required pam_faillock.so preauth audit silent deny=5 unlock_time=0

The complete set of pam_faillock.so rules in /etc/pam.d/system-auth-ac are like this:

auth required pam_faillock.so preauth audit silent deny=5 unlock_time=0 
auth [success=1 default=bad] pam_unix.so 
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=0 
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=0

Answer 1

pam_unix.so is the PAM module that handles authentication based on the traditional Unix files (/etc/passwd, /etc/shadow, etc.). success=1 tells PAM to skip the next module when authentication was successful (so it skips the authfail case of pam_faillock.so and goes directly to the authsucc case).

Essentially this module is what allows you to login in the first place.