Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-100559 | UBTU-18-010033 | SV-109663r1_rule | Medium |
Description |
---|
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. |
STIG | Date |
---|---|
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide | 2020-05-29 |
Check Text ( C-99417r1_chk ) |
---|
Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command: # grep pam_tally2 /etc/pam.d/common-auth auth required pam_tally2.so onerr=fail deny=3 If no line is returned or the line is commented out, this is a finding. If the line is missing "onerr=fail", this is a finding. If the line has "deny" set to a value more than 3, this is a finding. |
Fix Text (F-106245r1_fix) |
---|
Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts. Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the "auth" stack. So add the following line before the first "auth" entry in the file. auth required pam_tally2.so onerr=fail deny=3 |