Detections
Analytics

1.170 RHEL-10-500020

Information

RHEL 10 must log username information when unsuccessful login attempts occur.

GROUP ID: V-281100RULE ID: SV-281100r1165655

Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.

Solution

Configure RHEL 10 to log username information when unsuccessful login attempts occur.

Enable the feature using the following command:

$ sudo authselect enable-feature with-faillock

Add/modify the "/etc/security/faillock.conf" file to match the following line:

audit

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CAT|II, CCI|CCI-000044, Rule-ID|SV-281100r1165655_rule, STIG-ID|RHEL-10-500020, Vuln-ID|V-281100

Plugin: Unix

Control ID: 346a5b65842d2ec7945944043d04459ca29a9803e0f57cb10f48502d57a5e206