The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user automatically locks the account until released by an administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-219166	UBTU-18-010033	SV-219166r610963_rule		Medium

Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128

STIG	Date
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide	2021-06-16

Details

Check Text ( C-20891r569453_chk )
Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command: # grep pam_tally2 /etc/pam.d/common-auth auth required pam_tally2.so onerr=fail deny=3 If no line is returned or the line is commented out, this is a finding. If the line is missing "onerr=fail", this is a finding. If the line has "deny" set to a value more than 3, this is a finding.

Check Text ( C-20891r569453_chk )

Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command:

# grep pam_tally2 /etc/pam.d/common-auth

auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.
If the line is missing "onerr=fail", this is a finding.
If the line has "deny" set to a value more than 3, this is a finding.

Fix Text (F-20890r569454_fix)
Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts. Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the "auth" stack. So add the following line before the first "auth" entry in the file. auth required pam_tally2.so onerr=fail deny=3