Detections
Analytics

1.49 ALMA-09-008050

Information

AlmaLinux OS 9 must log username information when unsuccessful logon attempts occur.

GROUP ID: V-269152
RULE ID: SV-269152r1050034

Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.

Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000470-GPOS-00214

Solution

Configure AlmaLinux OS 9 to log username information when unsuccessful logon attempts occur.

Add/modify the "/etc/security/faillock.conf" file to match the following line:

audit

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-7a., 800-53|AU-12c., CCI|CCI-000044, CCI|CCI-000172, Rule-ID|SV-269152r1050034_rule, STIG-ID|ALMA-09-008050, Vuln-ID|V-269152

Plugin: Unix

Control ID: 75ce9202c4f374a055ddca3e1ba4f88a235c47dbdf5b3f0253c8a81df91fde61