SV-218081r603264: The system must require administrator action to unlock an account locked by excessive failed login attempts. | Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must require administrator action to unlock an account locked by excessive failed login attempts.

Description

Discussion Text

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000047CCE-27110-6SV-50393V-38592

References

DPMS Target Red Hat Enterprise Linux 6 DISA DPMS Target Red Hat Enterprise Linux 6 4046

Checks

OVAL

oval:mil.disa.fso.redhat.rhel6:var:3264 ← xccdf_mil.disa.stig_value_var_accounts_passwords_pam_faillock_unlock_time

DISA STIG (Manual Reference)

To ensure the failed password attempt policy is configured correctly, run the following command: 

# grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth

If the "unlock_time" parameter is set to a value other than "0", "never", or less than "900" on "auth" lines with the "pam_faillock.so" module, or is missing from these lines, this is a finding.

Note: The maximum configurable value for "unlock_time" is "604800".

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.redhat.rhel6:def:2992
# The system must require administrator action to unlock an account locked by excessive failed login attempts.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# authfail default unlock_time is set to 0, between 900 and 604800 inclusive, or never for sytem-auth
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -eq 0 ] )
}
# authsucc unlock_time is set to 0, between 900 and 604800 inclusive, or never for system-auth
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -eq 0 ] )
}
# preauth default unlock_time is set to 0, between 900 and 604800 inclusive, or never for system-auth
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/system-auth')" -eq 0 ] )
}
# account required pam-faillock.so is set for system-auth
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  grep -Pq '^\s*account\s+(?:(?:required))\s+pam_faillock\.so\s*$' '/etc/pam.d/system-auth' &>/dev/null
}
# authfail default unlock_time is set to 0, between 900 and 604800 inclusive, or never for password-auth
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -eq 0 ] )
}
# authsucc unlock_time is set to 0, between 900 and 604800 inclusive, or never for password-auth
# textfilecontent54_object (textfilecontent54_test)
test_6() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+authsucc.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -eq 0 ] )
}
# preauth default unlock_time is set to 0, between 900 and 604800 inclusive, or never for password-auth
# textfilecontent54_object (textfilecontent54_test)
test_7() {
  ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -ge 900 ] ) || ( (sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth') | grep -qxF 'never' ) || ( [ "$(sed -En 's/^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+|never).*$/\1/p' '/etc/pam.d/password-auth')" -eq 0 ] )
}
# account required pam-faillock.so is set for password-auth
# textfilecontent54_object (textfilecontent54_test)
test_8() {
  grep -Pq '^\s*account\s+(?:(?:required))\s+pam_faillock\.so\s*$' '/etc/pam.d/password-auth' &>/dev/null
}

if ( ( test_1 && ( test_2 || ( test_3 && test_4 ) ) ) && ( test_5 && ( test_6 || ( test_7 && test_8 ) ) ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# DISA STIG RHEL6 oval:mil.disa.fso.redhat.rhel6:def:2992
if [ ! -f "/etc/pam.d/system-auth" ]; then echo "PASS"; exit 0; fi
if grep -q "^\\s*auth\\s+required\\s+pam_faillock\\.so\\s+preauth\\s+silent\\s+deny=3\\s+unlock_time=900\\s+fail_interval=900" /etc/pam.d/system-auth && grep -q "^\\s*auth\\s+\\[default=die\\]\\s+pam_faillock\\.so\\s+authfail\\s+deny=3\\s+unlock_time=" /etc/pam.d/system-auth ]; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi

Remediation

To configure the system to lock out accounts after a number of incorrect logon attempts and require an administrator to unlock the account using "pam_faillock.so", modify the content of both "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" as follows: 

Add the following line immediately before the "pam_unix.so" statement in the "AUTH" section: 

auth required pam_faillock.so preauth silent deny=3 unlock_time=900 fail_interval=900

Add the following line immediately after the "pam_unix.so" statement in the "AUTH" section: 

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900 fail_interval=900

Add the following line immediately before the "pam_unix.so" statement in the "ACCOUNT" section: 

account required pam_faillock.so

Note that any updates made to "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" may be overwritten by the "authconfig" program.  The "authconfig" program should not be used.