Detections
Analytics

5.3.3.1.2 Ensure password unlock time is configured

Information

The unlock_time option, set in /etc/security/faillock.conf, controls how long a locked account remains locked before access is automatically re-enabled. Access is restored unlock_time seconds after the account is locked. A value of 0 means the account is never automatically unlocked and access can only be restored by resetting the faillock entries with the faillock(8) command.

A nonzero unlock_time automatically restores access after the configured interval, balancing protection against brute force attacks with the operational cost of locked-out accounts and reducing administrative overhead. Setting unlock_time to 0 maximizes protection by keeping an account locked until an administrator resets it, at the cost of requiring manual recovery.

Solution

Set password unlock time to conform to site policy. unlock_time should be 0 (never), or 900 seconds or greater.

Edit /etc/security/faillock.conf and update or add the following line:

unlock_time = 900

Run the following script to remove the unlock_time argument from the pam_faillock.so module in the PAM files:

#!/usr/bin/env bash

{
 for l_pam_file in system-auth password-auth; do
 l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
 sed -ri 's/(^\s*auth\s+(requisite|required|sufficient)\s+pam_faillock\.so.*)(\s+unlock_time\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
 done
 authselect apply-changes
}

Impact:

Use of unlock_time=0 may allow an attacker to cause denial of service to legitimate users. This will also require a systems administrator with elevated privileges to unlock the account.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), 800-53|IA-5, CSCv7|16.7

Plugin: Unix

Control ID: 28dbd5ee560239bbf8046231932dd2bf5fd437635541136c3be601ba55f93436