Detections
Analytics

1.45 ALMA-09-007610

Information

AlmaLinux OS 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.

GROUP ID: V-269148
RULE ID: SV-269148r1050030

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Solution

Configure AlmaLinux OS 9 to lock the root account after a number of incorrect login attempts using pam_faillock.

First, enable the feature using the following command:

$ authselect enable-feature with-faillock

Then, add or uncomment the following line in the "/etc/security/faillock.conf" file:

even_deny_root

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CCI|CCI-000044, Rule-ID|SV-269148r1050030_rule, STIG-ID|ALMA-09-007610, Vuln-ID|V-269148

Plugin: Unix

Control ID: d2e723d1e06e683c5b30dd8ab16d7cca3f6ac1f11979d8ae4d059c8bc014cbe4