Accounts subject to three unsuccessful logon attempts within 15 minutes must be locked for the maximum configurable period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-71943	RHEL-07-010320	SV-86567r3_rule		Medium

Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005

STIG	Date
Red Hat Enterprise Linux 7 Security Technical Implementation Guide	2017-12-14

Details

Check Text ( C-72175r3_chk )
Verify the operating system automatically locks an account for the maximum period for which the system can be configured. Check that the system locks an account for the maximum period after three unsuccessful logon attempts within a period of 15 minutes with the following command: # grep pam_faillock.so /etc/pam.d/password-auth-ac auth required pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=604800 auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=604800 account required pam_faillock.so If the "unlock_time" setting is greater than "604800" on both lines with the "pam_faillock.so" module name or is missing from a line, this is a finding. # grep pam_faillock.so /etc/pam.d/system-auth-ac auth required pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=604800 auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=604800 account required pam_faillock.so If the "unlock_time" setting is greater than "604800" on both lines with the "pam_faillock.so" module name or is missing from a line, this is a finding.

Check Text ( C-72175r3_chk )

Verify the operating system automatically locks an account for the maximum period for which the system can be configured.

Check that the system locks an account for the maximum period after three unsuccessful logon attempts within a period of 15 minutes with the following command:

# grep pam_faillock.so /etc/pam.d/password-auth-ac
auth required pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=604800
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=604800
account required pam_faillock.so

If the "unlock_time" setting is greater than "604800" on both lines with the "pam_faillock.so" module name or is missing from a line, this is a finding.

# grep pam_faillock.so /etc/pam.d/system-auth-ac
auth required pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=604800
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=604800
account required pam_faillock.so

If the "unlock_time" setting is greater than "604800" on both lines with the "pam_faillock.so" module name or is missing from a line, this is a finding.

Fix Text (F-78295r4_fix)
Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made. Modify the first three lines of the auth section of the "/etc/pam.d/system-auth-ac" and "/etc/pam.d/password-auth-ac" files to match the following lines: auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=604800 auth sufficient pam_unix.so try_first_pass auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=604800 account required pam_faillock.so

Fix Text (F-78295r4_fix)

Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.

Modify the first three lines of the auth section of the "/etc/pam.d/system-auth-ac" and "/etc/pam.d/password-auth-ac" files to match the following lines:

auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=604800
auth sufficient pam_unix.so try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=604800
account required pam_faillock.so