documentation_complete: true

title: 'Set Lockout Time For Failed Password Attempts'

description: |-
    To configure the system to lock out accounts after a number of incorrect login
    attempts and require an administrator to unlock the account using <tt>pam_faillock.so</tt>,
    modify the content of both <tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt> as follows:
    <br /><br />
    <ul>
    <li> Add the following line immediately <tt>before</tt> the <tt>pam_unix.so</tt> statement in the <tt>AUTH</tt> section:
    <pre>auth required pam_faillock.so preauth silent deny=<sub idref="var_accounts_passwords_pam_faillock_deny" /> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time" /> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval" /></pre></li>
    <li> Add the following line immediately <tt>after</tt> the <tt>pam_unix.so</tt> statement in the <tt>AUTH</tt> section:
    <pre>auth [default=die] pam_faillock.so authfail deny=<sub idref="var_accounts_passwords_pam_faillock_deny" /> unlock_time=<sub idref="var_accounts_passwords_pam_faillock_unlock_time" /> fail_interval=<sub idref="var_accounts_passwords_pam_faillock_fail_interval" /></pre></li>
    <li> Add the following line immediately <tt>before</tt> the <tt>pam_unix.so</tt> statement in the <tt>ACCOUNT</tt> section:
    <pre>account required pam_faillock.so</pre></li>
    </ul>

rationale: |-
    Locking out user accounts after a number of incorrect attempts
    prevents direct password guessing attacks.  Ensuring that an administrator is
    involved in unlocking locked accounts draws appropriate attention to such
    situations.

severity: medium

identifiers:
    cce: 27110-6

references:
    cidss: Req-8.1.7
    disa: 47
    nist: AC-7(b)
    srg: SRG-OS-000022
    stigid: RHEL-06-000356

ocil_clause: 'that is not the case'

ocil: |-
    To ensure the failed password attempt policy is configured correctly, run the following command:
    <pre>$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth</pre>
    The output should show <tt>unlock_time=&lt;some-large-number&gt;</tt>; the largest acceptable value is 604800 seconds (one week).
