Detections
Analytics

1.154 AZLX-23-002420

Information

Amazon Linux 2023 must automatically lock an account when three unsuccessful logon attempts occur.

GROUP ID: V-274147
RULE ID: SV-274147r1120429

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Amazon Linux 2023 can utilize the "pam_faillock.so" for this purpose. Note that manual changes to the listed files may be overwritten by the "authselect" program.

From "Pam_Faillock" man pages: Note that the default directory that "pam_faillock" uses is usually cleared on system boot so the access will be re-enabled after system reboot. If that is undesirable, a different tally directory must be set with the "dir" option.

Solution

Configure Amazon Linux 2023 to lock an account when three unsuccessful logon attempts occur.

Add/Modify the appropriate sections of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines:

auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0

auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0

account required pam_faillock.so

The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:

$ sudo systemctl restart sssd.service

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CAT|II, CCI|CCI-000044, Rule-ID|SV-274147r1120429_rule, STIG-ID|AZLX-23-002420, Vuln-ID|V-274147

Plugin: Unix

Control ID: 4225775ace68f5e92c9382f3d96d2d983b16f80e34249152d16aa615f52eda51