Detections
Analytics
5.3.3.1.3 Ensure password failed attempts lockout includes root account
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
even_deny_root - Root account can become locked as well as regular accountsroot_unlock_time=n - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.
Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Solution
Edit /etc/security/faillock.conf :- Remove or update any line containing root_unlock_time, - OR - set it to a value of 60 or more
- Update or add the following line:
even_deny_root
Run the following script to remove the even_deny_root and root_unlock_time arguments from the pam_faillock.so module in the PAM files:
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*auth\s+(.*)\s+pam_faillock\.so.*)(\s+even_deny_root)(.*$)/\1\4/' "$l_authselect_file"
sed -ri 's/(^\s*auth\s+(.*)\s+pam_faillock\.so.*)(\s+root_unlock_time\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
``
Impact:
Use of unlock_time=0 or root_unlock_time=0 may allow an attacker to cause denial of service to legitimate users.
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v2.0.0 L2 Server
Category: ACCESS CONTROL
References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), CSCv7|16.7
Plugin: Unix
Control ID: 516c2bede77b0dcef9a4c32028683ea3a7c1443a2fe9e2ef30bfa3c7f6240177