UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must disable accounts after excessive login failures within a 15-minute interval.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38501 RHEL-06-000357 SV-50302r1_rule Medium
Description
Locking out user accounts after a number of incorrect attempts within a specific period of time prevents direct password guessing attacks.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2013-06-03

Details

Check Text ( C-46058r1_chk )
To ensure the failed password attempt policy is configured correctly, run the following command:

# grep pam_faillock /etc/pam.d/system-auth-ac

The output should show "fail_interval=" where "interval-in-seconds" is 900 (15 minutes) or greater. If the "fail_interval" parameter is not set, the default setting of 900 seconds is acceptable.
If that is not the case, this is a finding.
Fix Text (F-43448r1_fix)
To configure the system to lock out accounts after a number of incorrect login attempts within a 15-minute interval using "pam_faillock.so":

Add the following lines immediately below the "pam_env.so" statement in the AUTH section of
"/etc/pam.d/system-auth-ac":

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900



auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Note that any updates made to "/etc/pam.d/system-auth-ac" will be overwritten by the "authconfig" program. The "authconfig" program should not be used.