Detections
Analytics

5.3.3.1.1 Ensure password failed attempts lockout is configured

Information

The deny=<n> option will deny access if the number of consecutive authentication failures for this user during the recent interval exceeds <n>.

Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.

Solution

Create or edit the following line in /etc/security/faillock.conf setting the deny option to 5 or less:

deny = 5

Run the following command:

# grep -Pl -- '\bpam_faillock\.so\h+([^#\n\r]+\h+)?deny\b' /usr/share/pam-configs/*

Edit any returned files and remove the deny=<N> arguments from the pam_faillock.so line(s).

Impact:

Locking out accounts after repeated failed attempts can be used to deny service to legitimate users if an attacker submits multiple incorrect authentication attempts. Consider combining with root_unlock_time (5.3.3.1.3) to limit the denial-of-service exposure for the root account.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), CSCv7|16.7

Plugin: Unix

Control ID: c8360bed8ca2064b616dda06b532eccab249105ccdfce5a5afe30b8cfdef219f