The Photon operating system must be configured to use the pam_faillock.so module.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258858	SRG-OS-000021-GPOS-00005	PHTN-40-000192	SV-258858r958388_rule	2024-07-11	2

Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications.

Description

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications.

ℹ️ Check
At the command line, run the following commands to verify the pam_faillock.so module is used: # grep '^auth' /etc/pam.d/system-auth Example result: auth required pam_faillock.so preauth auth required pam_unix.so auth required pam_faillock.so authfail If the pam_faillock.so module is not present with the "preauth" line listed before pam_unix.so, this is a finding. If the pam_faillock.so module is not present with the "authfail" line listed after pam_unix.so, this is a finding. # grep '^account' /etc/pam.d/system-account Example result: account required pam_faillock.so account required pam_unix.so If the pam_faillock.so module is not present and listed before pam_unix.so, this is a finding.

ℹ️ Check

At the command line, run the following commands to verify the pam_faillock.so module is used: # grep '^auth' /etc/pam.d/system-auth Example result: auth required pam_faillock.so preauth auth required pam_unix.so auth required pam_faillock.so authfail If the pam_faillock.so module is not present with the "preauth" line listed before pam_unix.so, this is a finding. If the pam_faillock.so module is not present with the "authfail" line listed after pam_unix.so, this is a finding. # grep '^account' /etc/pam.d/system-account Example result: account required pam_faillock.so account required pam_unix.so If the pam_faillock.so module is not present and listed before pam_unix.so, this is a finding.

✔️ Fix
Navigate to and open: /etc/pam.d/system-auth Add or update the following lines making sure to place the preauth line before the pam_unix.so module: auth required pam_faillock.so preauth auth required pam_faillock.so authfail Navigate to and open: /etc/pam.d/system-account Add or update the following lines making sure to place the line before the pam_unix.so module: account required pam_faillock.so Note: The lines shown assume the /etc/security/faillock.conf file is used to configure pam_faillock. Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.

✔️ Fix

Navigate to and open: /etc/pam.d/system-auth Add or update the following lines making sure to place the preauth line before the pam_unix.so module: auth required pam_faillock.so preauth auth required pam_faillock.so authfail Navigate to and open: /etc/pam.d/system-account Add or update the following lines making sure to place the line before the pam_unix.so module: account required pam_faillock.so Note: The lines shown assume the /etc/security/faillock.conf file is used to configure pam_faillock. Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.