RHEL 9 must ensure account lockouts persist.
An XCCDF Rule
Description
Having lockouts persist across reboots ensures that account is only unlocked by an administrator. If the lockouts did not persist across reboots, an attacker could simply reboot the system to continue brute force attacks against the accounts on the system.
- ID
- SV-258060r1045150_rule
- Version
- RHEL-09-411105
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure RHEL 9 maintain the contents of the faillock directory after a reboot.
Add/modify the "/etc/security/faillock.conf" file to match the following line:
dir = /var/log/faillock