Detections
Analytics

1.46 ALMA-09-007720

Information

AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.

GROUP ID: V-269149
RULE ID: SV-269149r1184091

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Solution

Configure AlmaLinux OS 9 to lock an account after a number of incorrect login attempts within 15 minutes using pam_faillock.

First, enable the feature using the following command:

$ authselect enable-feature with-faillock

Then, add or uncomment the following line in the "/etc/security/faillock.conf" file:

fail_interval = 900

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CCI|CCI-000044, Rule-ID|SV-269149r1184091_rule, STIG-ID|ALMA-09-007720, Vuln-ID|V-269149

Plugin: Unix

Control ID: 0c858cd2b570d4fb361571fd0b99d6c2e0fe5182dfb909c11e49c14e5e2896a1