Detections
Analytics
RHEL-06-000356 - The system must require administrator action to unlock an account locked by excessive failed login attempts - 'system-auth auth required'
Information
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.Solution
To configure the system to lock out accounts after a number of incorrect logon attempts and require an administrator to unlock the account using 'pam_faillock.so', modify the content of both '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' as follows:Add the following line immediately before the 'pam_unix.so' statement in the 'AUTH' section:
auth required pam_faillock.so preauth silent deny=3 unlock_time=900 fail_interval=900
Add the following line immediately after the 'pam_unix.so' statement in the 'AUTH' section:
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900 fail_interval=900
Add the following line immediately before the 'pam_unix.so' statement in the 'ACCOUNT' section:
account required pam_faillock.so
Note that any updates made to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' may be overwritten by the 'authconfig' program. The 'authconfig' program should not be used.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_6_V2R2_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 6 STIG v2r2
Category: ACCESS CONTROL
References: 800-53|AC-7b., CAT|II, CCI|CCI-000047, Rule-ID|SV-218081r603264_rule, STIG-ID|RHEL-06-000356, STIG-Legacy|SV-50393, STIG-Legacy|V-38592, Vuln-ID|V-218081
Plugin: Unix
Control ID: e24d071d86c93d180b278cd1ba562a42d3d2cda3020ec48d77f9fe5f64102d07