RHEL 9 must log username information when unsuccessful logon attempts occur.
An XCCDF Rule
Description
Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.
- ID
- SV-258070r1045153_rule
- Version
- RHEL-09-412045
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure RHEL 9 to log username information when unsuccessful logon attempts occur.
Enable the feature using the following command:
$ sudo authselect enable-feature with-faillock