OL07-00-010320 - The Oracle Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe.

Information

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005

Solution

Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.

Add/Modify the appropriate sections of the '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' files to match the following lines:

auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
auth sufficient pam_unix.so try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
account required pam_faillock.so

Note: Per requirement OL07-00-010199, Oracle Linux 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_7_V2R14_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., 800-53|AC-7b., CAT|II, CCI|CCI-000044, CCI|CCI-002236, CCI|CCI-002237, CCI|CCI-002238, Rule-ID|SV-221690r880681_rule, STIG-ID|OL07-00-010320, STIG-Legacy|SV-108223, STIG-Legacy|V-99119, Vuln-ID|V-221690

Plugin: Unix

Control ID: 563b505e7c15579bcb13eb110845d8a9f488cc681fdb10737ca13364a9528b5f