The Photon operating system must be configured to use the pam_faillock.so module.

An XCCDF Rule

Description

<VulnDiscussion>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-258858r958388_rule
Severity: Medium
References: CCI-000044
Updated: 20 days ago

Navigate to and open:

/etc/pam.d/system-auth

Add or update the following lines making sure to place the preauth line before the pam_unix.so module:
auth required pam_faillock.so preauth
auth required pam_faillock.so authfail

Navigate to and open:

/etc/pam.d/system-account

Add or update the following lines making sure to place the line before the pam_unix.so module:

account required pam_faillock.so

Note: The lines shown assume the /etc/security/faillock.conf file is used to configure pam_faillock.

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.

The Photon operating system must be configured to use the pam_faillock.so module.

Description

Remediation - Manual Procedure