Detections
Analytics
5.3.2.2 Ensure pam_faillock module is enabled
Information
The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the deny parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory.Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Solution
On a system already managed by an authselect profile, run the following commands to enable the faillock feature and apply the changes:# authselect enable-feature with-faillock
# authselect apply-changes
authselect regenerates /etc/pam.d/system-auth and /etc/pam.d/password-auth with the pam_faillock.so lines.
If the system is not yet managed by authselect, or authselect check reports the configuration is not valid, first establish or restore the profile as described in the section overview, then run the commands above.
Impact:
Enabling pam_faillock introduces account-lockout behavior: after the configured number of consecutive failed authentication attempts an account is locked for the configured interval. An aggressive threshold can lock out legitimate users and become a self-inflicted denial-of-service vector, so confirm the lockout thresholds are appropriate for the environment and be familiar with the unlock procedure ( faillock --user <name> --reset ).
See Also
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-7a.
Plugin: Unix
Control ID: 01a09f6fdd20d8d769b99f21b65fa3ff9e1858b59c509892d124a5d2b0a0ae8d