SV-37203r1: The system must disable accounts after three consecutive unsuccessful login attempts. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must disable accounts after three consecutive unsuccessful login attempts.

Description

Discussion Text

Disabling accounts after a limited number of unsuccessful login attempts improves protection against password guessing attacks.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000044CCE-3410-8

Additional Details

Responsibility

System Administrator

IA Controls

ECLO-1, ECLO-2

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.rhel11:def:50
if [ ! -d "/etc/pam.d" ]; then echo "PASS"; exit 0; fi
for file in /etc/pam.d/system-auth system-auth-ac system-auth-local; do
    if [ -f "$file" ]; then
        if grep -q '^auth[[:space:]]required[[:space:]]pam_tally2.so[[:space:]]deny=3' "$file"; then
            echo "PASS"; exit 0
        fi
    fi
done
echo "FAIL"; exit 1

Remediation

By default link /etc/pam.d/system-auth points to /etc/pam.d/system-auth-ac which is the file maintained by the authconfig utility. In order to add pam options other than those available via the utility create /etc/pam.d/system-auth-local with the options and including system-auth-ac. In order to set the account lockout to three failed attempts the content should be similar to:

auth required pam_access.so
auth required pam_tally2.so deny=3
auth include system-auth-ac
account required pam_tally2.so
account include system-auth-ac
password include system-auth-ac
session include system-auth-ac

Once system-auth-local is written reset the /etc/pam.d/system-auth to point to system-auth-local. This is necessary because authconfig writes directly to system-auth-ac so any changes made by hand will be lost if authconfig is run.