SV-250315r1017356: RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory. | Red Hat Enterprise Linux 8 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.

Description

Discussion Text

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. From "faillock.conf" man pages: Note that the default directory that "pam_faillock" uses is usually cleared on system boot so the access will be re-enabled after system reboot. If that is undesirable, a different tally directory must be set with the "dir" option. SELinux, enforcing a targeted policy, will require any non-default tally directory's security context type to match the default directory's security context type. Without updating the security context type, the pam_faillock module will not write failed login attempts to the non-default tally directory.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000044Not mappedCCI-002238

References

DPMS Target Red Hat Enterprise Linux 8 DISA DPMS Target Red Hat Enterprise Linux 8 2921

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel8os:def:250315
# RHEL 8 systems, versions 8.2 and above, must configure SELinux context type to allow the use of a non-default faillock tally directory.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - selinuxsecuritycontext_object (selinuxsecuritycontext_test) -- configured faillock directory has correct selinux context: no extractor for field "type"

# /etc/security/faillock.conf dir option exists
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '^\s*dir\s*=\s*(.*)\s*$' '/etc/security/faillock.conf' &>/dev/null
}

if test_2; then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# DISA STIG RHEL 8 OS rule: oval:mil.disa.stig.rhel8os:def:250315

if [ ! -d "/var/log/faillock" ]; then mkdir /var/log/faillock; fi
if [ ! -e "/etc/security/faillock.conf" ]; then echo "FAIL"; exit 1; fi
if ! grep -q "^\\s*dir\\s*=\\s*/var/log/faillock\\s*$" /etc/security/faillock.conf; then echo "FAIL"; exit 1; fi
semanage fcontext -a -t faillog_t "/var/log/faillock(/.*)?" > /dev/null 2>&1
if [ $? -ne 0 ]; then echo "FAIL"; exit 1; fi
echo "PASS"
exit 0

Remediation

Configure RHEL 8 to allow the use of a non-default faillock tally directory while SELinux enforces a targeted policy.

Create a non-default faillock tally directory (if it does not already exist) with the following example:

$ sudo mkdir /var/log/faillock

Update the /etc/selinux/targeted/contexts/files/file_contexts.local with "faillog_t" context type for the non-default faillock tally directory with the following command:

$ sudo semanage fcontext -a -t faillog_t "/var/log/faillock(/.*)?" 

Next, update the context type of the non-default faillock directory/subdirectories and files with the following command:	

$ sudo restorecon -R -v /var/log/faillock