OpenControls Logo

STIG Viewer

The Photon operating system must be configured to use the pam_faillock.so module.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258858PHTN-40-000192SV-258858r933635_ruleCCI-000044medium
Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications.
STIGDate
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide2023-10-29

Related Frameworks

3 paths across 3 frameworks
NIST 800-531 mapping
AC-7
1.00
  • DISA · V1R1 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.1.8
1.00
  • DISA · V1R1 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
  • NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000044
1.00
  • DISA · V1R1 · disa_xccdf · related

Details

Check Text (C-258858r933635_chk)

At the command line, run the following commands to verify the pam_faillock.so module is used: # grep '^auth' /etc/pam.d/system-auth Example result: auth required pam_faillock.so preauth auth required pam_unix.so auth required pam_faillock.so authfail If the pam_faillock.so module is not present with the "preauth" line listed before pam_unix.so, this is a finding. If the pam_faillock.so module is not present with the "authfail" line listed after pam_unix.so, this is a finding. # grep '^account' /etc/pam.d/system-account Example result: account required pam_faillock.so account required pam_unix.so If the pam_faillock.so module is not present and listed before pam_unix.so, this is a finding.

Fix Text (F-62507r933634_fix)

Navigate to and open: /etc/pam.d/system-auth Add or update the following lines making sure to place the preauth line before the pam_unix.so module: auth required pam_faillock.so preauth auth required pam_faillock.so authfail Navigate to and open: /etc/pam.d/system-account Add or update the following lines making sure to place the line before the pam_unix.so module: account required pam_faillock.so Note: The lines shown assume the /etc/security/faillock.conf file is used to configure pam_faillock. Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.