Detections
Analytics

5.3.3.1.3 Ensure password failed attempts lockout includes root account

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

even_deny_root - Root account can become locked as well as regular accounts

 root_unlock_time=n - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.

Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.

Solution

Edit /etc/security/faillock.conf :

 - Remove or update any line containing root_unlock_time, - OR - set it to a value of 60 or more
 - Update or add the following line:
even_deny_root

Run the following command:

 # grep -Pl -- '\bpam_faillock\.so\h+([^#\n\r]+\h+)?(root_unlock_time=([0-9]|[1-5][0-9]))' /usr/share/pam-configs/*

Edit any returned files and remove the root_unlock_time arguments from the pam_faillock.so line(s) and run the following command to regenerate the effected pam files:

 # pam-auth-update

Impact:

Use of unlock_time=0 or root_unlock_time=0 may allow an attacker to cause denial of service to legitimate users.

See Also

https://workbench.cisecurity.org/benchmarks/18960

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), CSCv7|16.7

Plugin: Unix

Control ID: a7b8ebb3167684d900d09a516c5c4a3aa73eb82309b5137b2febf1aee461a789