AlmaLinux OS 9 must log username information when unsuccessful logon attempts occur.
An XCCDF Rule
Description
Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000470-GPOS-00214
- ID
- SV-269152r1050034_rule
- Version
- ALMA-09-008050
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure AlmaLinux OS 9 to log username information when unsuccessful logon attempts occur.
Add/modify the "/etc/security/faillock.conf" file to match the following line:
audit