Skip to content
ATO Pathways
  Log In

An SELinux Context must be configured for default pam_tally2 file option

An XCCDF Rule

Description

The file configuration option in PAM pam_tally2.so module defines where to keep counts. Default is /var/log/tallylog. The configured directory must have the correct SELinux context.

Rationale

Not having the correct SELinux context on the pam_tally2.so file may lead to unauthorized access to the directory.

ID
xccdf_org.ssgproject.content_rule_accounts_passwords_pam_tally2_file_selinux
Severity
Medium
References
Updated



Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-94088-2
  - DISA-STIG-SLEM-05-412030

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

#!/bin/bash

if ! semanage fcontext -a -t faillog_t "/var/log/tallylog"; then