Rotate your device back to portrait to use STIG Vault.
The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.
Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Rule Text
Discussion Text
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.
To ensure the failed password attempt policy is configured correctly, run the following command:
# grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
The output should show "deny=3" for both files.
If that is not the case, this is a finding.
To configure the system to lock out accounts after a number of incorrect logon attempts using "pam_faillock.so", modify the content of both "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" as follows:
Add the following line immediately before the "pam_unix.so" statement in the "AUTH" section:
auth required pam_faillock.so preauth silent deny=3 unlock_time=900 fail_interval=900
Add the following line immediately after the "pam_unix.so" statement in the "AUTH" section:
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900 fail_interval=900
Add the following line immediately before the "pam_unix.so" statement in the "ACCOUNT" section:
account required pam_faillock.so
Note that any updates made to "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" may be overwritten by the "authconfig" program. The "authconfig" program should not be used.