← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-768

CAT II (Medium)

The delay between login prompts following a failed login attempt must be at least 4 seconds.

Rule ID

SV-44838r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-002238

Discussion

Enforcing a delay between successive failed login attempts increases protection against automated password guessing attacks.

Check Content

Check the value of the FAIL_DELAY variable and the ability to use it

Procedure:.
# grep FAIL_DELAY /etc/login.defs 
If the value does not exist, or is less than 4, this is a finding.

Check for the use of pam_faildelay.
# grep pam_faildelay /etc/pam.d/common-auth*
If the pam_faildelay.so module is not listed, this is a finding.

Fix Text

Add the pam_faildelay module and set the FAIL_DELAY variable.

Procedure:
Edit /etc/login.defs and set the value of the FAIL_DELAY variable to 4 or more.

Edit /etc/pam.d/common-auth and add a pam_faildelay entry if one does not exist, such as:
auth optional pam_faildelay.so