5.3.7 Ensure lockout for unsuccessful root logon attempts - system-auth required

Information

The operating system must lock the associated account after 3 unsuccessful root logon attempts are made within a 15-minute period.

Rationale:

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

Solution

To configure the operating system to lock automatically the root account until the locked account is released by an administrator when 3 unsuccessful logon attempts in 15 minutes are made.
Modify the first 3 lines of the auth section and the first line of the account section of the /etc/pam.d/system-auth and /etc/pam.d/password-auth files to match the following lines:
Example: vim /etc/pam.d/system-auth
Add, uncomment or update the following lines in each file:

auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
auth sufficient pam_unix.so try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
account required pam_faillock.so

Impact:

Note: Manual changes to the listed files may be overwritten by the 'authconfig' program. The 'authconfig' program should not be used to update the configurations listed in this requirement.

Notes:

This Benchmark recommendation maps to:

Red Hat Enterprise Linux 7 Security Technical Implementation Guide:

Version 2, Release: 3 Benchmark Date: 26 Apr 2019



Vul ID: V-71945

Rule ID: SV-86569r4_rule

STIG ID: RHEL-07-010330

Severity: CAT II

See Also

https://workbench.cisecurity.org/files/2688

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a.

Plugin: Unix

Control ID: 55f2161084ce18257402b9a848c6a7d8ca2e3fca788b79b8255b23d10cd51595