UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must disable accounts after three consecutive unsuccessful logon attempts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38573 RHEL-06-000061 SV-50374r3_rule Medium
Description
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-03-06

Details

Check Text ( C-46131r3_chk )
To ensure the failed password attempt policy is configured correctly, run the following command:

# grep pam_faillock /etc/pam.d/system-auth
# grep pam_faillock /etc/pam.d/password-auth

The output should show "deny=3" for both files.
If that is not the case, this is a finding.
Fix Text (F-43521r5_fix)
To configure the system to lock out accounts after a number of incorrect logon attempts using "pam_faillock.so":

Add the following lines immediately below the "pam_unix.so" statement in the AUTH section of "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth":

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Note that any updates made to "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" may be overwritten by the "authconfig" program. The "authconfig" program should not be used.