Detections
Analytics

5.3.3.1.1 Ensure password failed attempts lockout is configured

Information

The pam_faillock module locks an account after a number of consecutive failed authentication attempts. The deny option, set in /etc/security/faillock.conf, defines that threshold: the number of consecutive failed authentication attempts after which the account is locked. A value of 0 disables the lockout.

Locking an account after a defined number of consecutive failed authentication attempts limits the number of password guesses an attacker can make in a short period, mitigating brute force and password-spraying attacks. Setting deny to a low, non-zero value ensures an account is locked before an attacker can attempt a large number of credentials.

Solution

Create or edit the following line in /etc/security/faillock.conf setting the deny option to 5 or less:

deny = 5

Run the following script to remove the deny argument from the pam_faillock.so module in the PAM files:

#!/usr/bin/env bash

{
 for l_pam_file in system-auth password-auth; do
 l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
 sed -ri 's/(^\s*auth\s+(requisite|required|sufficient)\s+pam_faillock\.so.*)(\s+deny\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
 done
 authselect apply-changes
}

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), 800-53|IA-5, CSCv7|16.7

Plugin: Unix

Control ID: bee4356ac09069106b3f4c74e2504e81e0462524c3272597c73d1fa260e17f08