Detections
Analytics

1.267 RHEL-10-600430

Information

RHEL 10 must ensure account lockouts persist.

GROUP ID: V-281198
RULE ID: SV-281198r1166546

Having lockouts persist across reboots ensures that an account is unlocked only by an administrator. If the lockouts did not persist across reboots, an attacker could reboot the system to continue brute force attacks against the accounts on the system.

Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128

Solution

Configure RHEL 10 to maintain the contents of the "faillock" directory after a reboot.

Add/modify the "/etc/security/faillock.conf" file to match the following line:

dir = /var/log/faillock

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., 800-53|AC-7b., CAT|II, CCI|CCI-000044, CCI|CCI-002238, Rule-ID|SV-281198r1166546_rule, STIG-ID|RHEL-10-600430, Vuln-ID|V-281198

Plugin: Unix

Control ID: 37e5062ef8fc3b3289b958375d4bd129be934d27001fda2c6af40a42cfb01c78