UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must disable accounts after excessive login failures within a 15-minute interval.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38501 RHEL-06-000357 SV-50302r3_rule Medium
Description
Locking out user accounts after a number of incorrect attempts within a specific period of time prevents direct password guessing attacks.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-03-06

Details

Check Text ( C-46058r2_chk )
To ensure the failed password attempt policy is configured correctly, run the following command:

$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth

For each file, the output should show "fail_interval=" where "interval-in-seconds" is 900 (15 minutes) or greater. If the "fail_interval" parameter is not set, the default setting of 900 seconds is acceptable. If that is not the case, this is a finding.
Fix Text (F-43448r4_fix)
Utilizing "pam_faillock.so", the "fail_interval" directive configures the system to lock out accounts after a number of incorrect logon attempts.

Add the following "fail_interval" directives to "pam_faillock.so" immediately below the "pam_unix.so" statement in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth":

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900