V-248658

Discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. OL 8 can use the "pam_faillock.so" for this purpose. Note that manual changes to the listed files may be overwritten by the "authselect" program. From "Pam_Faillock" man pages: Note that the default directory that "pam_faillock" uses is usually cleared on system boot so the access will be reenabled after system reboot. If that is undesirable, a different tally directory must be set with the "dir" option. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128

Check Content

Verify the faillock directory contents persist after a reboot with the following commands: 
 
Note: This check applies to OL versions 8.0 and 8.1. If the system is OL version 8.2 or newer, this check is not applicable. 
 
$ sudo grep pam_faillock.so /etc/pam.d/password-auth 
 
auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0 
auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0 
account required pam_faillock.so 
 
If the "dir" option is not set to a non-default documented tally log directory on the "preauth" and "authfail" lines with the "pam_faillock.so" module or is missing from these lines, this is a finding. 
 
$ sudo grep pam_faillock.so /etc/pam.d/system-auth 
 
auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny=3 even_deny_root fail_interval=900 unlock_time=0 
auth required pam_faillock.so authfail dir=/var/log/faillock unlock_time=0 
account required pam_faillock.so 
 
If the "dir" option is not set to a non-default documented tally log directory on the "preauth" and "authfail" lines with the "pam_faillock.so" module or is missing from these lines, this is a finding.