The system must require administrator action to unlock an account locked by excessive failed login attempts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-38592	RHEL-06-000356	SV-50393r1_rule		Medium

Description
Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-06-03

Details

Check Text ( C-46151r1_chk )
To ensure the failed password attempt policy is configured correctly, run the following command: # grep pam_faillock /etc/pam.d/system-auth-ac The output should show "unlock_time="; the largest acceptable value is 604800 seconds (one week). If that is not the case, this is a finding.

Fix Text (F-43541r1_fix)
To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using "pam_faillock.so": Add the following lines immediately below the "pam_unix.so" statement in the AUTH section of "/etc/pam.d/system-auth-ac": auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900 auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900 Note that any updates made to "/etc/pam.d/system-auth-ac" will be overwritten by the "authconfig" program. The "authconfig" program should not be used.

Fix Text (F-43541r1_fix)

To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using "pam_faillock.so":

Add the following lines immediately below the "pam_unix.so" statement in the AUTH section of
"/etc/pam.d/system-auth-ac":

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Note that any updates made to "/etc/pam.d/system-auth-ac" will be overwritten by the "authconfig" program. The "authconfig" program should not be used.