UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must disable accounts after three consecutive unsuccessful login attempts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38573 RHEL-06-000061 SV-50374r2_rule Medium
Description
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2014-06-10

Details

Check Text ( None )
None
Fix Text (F-43521r3_fix)
To configure the system to lock out accounts after a number of incorrect login attempts using "pam_faillock.so":

Add the following lines immediately below the "pam_unix.so" statement in the AUTH section of "/etc/pam.d/system-auth-ac" and "/etc/pam.d/password-auth-ac":

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900



auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Note that any updates made to "/etc/pam.d/system-auth-ac" and "/etc/pam.d/password-auth-ac" will be overwritten by the "authconfig" program. The "authconfig" program should not be used.