Detections
Analytics
5.3.3.1.3 Ensure password failed attempts lockout includes root account
Information
even_deny_root - Root account can become locked as well as regular accountsroot_unlock_time=n - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.
By default the root account is exempt from pam_faillock lockout, leaving it able to be subjected to unlimited password-guessing attempts. Because root is a high-value target, including it in the lockout with even_deny_root applies the same brute force protection to the most privileged account. A finite root_unlock_time can be used to balance this protection against the need to recover the root account.
Solution
Edit /etc/security/faillock.conf :- Remove or update any line containing root_unlock_time, - OR - set it to a value of 60 or more
- Update or add the following line:
even_deny_root
Run the following script to remove the even_deny_root and root_unlock_time arguments from the pam_faillock.so module in the PAM files:
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*auth\s+(.*)\s+pam_faillock\.so.*)(\s+even_deny_root)(.*$)/\1\4/' "$l_authselect_file"
sed -ri 's/(^\s*auth\s+(.*)\s+pam_faillock\.so.*)(\s+root_unlock_time\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
Impact:
Enabling even_deny_root causes the root account to be locked after repeated failed authentication attempts, the same as any other account. On a system with no alternate privileged access path (for example, no sudo -capable user and no console or single-user recovery), a locked root account can block emergency administration. Before enabling this on remote or headless systems, ensure an alternate recovery path exists, or set a finite root_unlock_time so the root account unlocks automatically after the configured interval. Setting root_unlock_time=0 keeps the root account locked until an administrator resets the faillock entries, which may cause a denial of service to legitimate administrators.
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L2 Workstation
Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION
References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), 800-53|IA-5, CSCv7|16.7
Plugin: Unix
Control ID: f413ab1bb48c409a063771b3e455c4e4ee69ba2574595ebc0a41ab4e7db0decf