documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Interval For Counting Failed Password Attempts'

description: "Utilizing <tt>pam_faillock.so</tt>, the <tt>fail_interval</tt> directive \nconfigures the system to lock out an accounts after a number of incorrect login\nattempts within a specified time period. Modify the content of both \n<tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt> as follows:\n<br /><br />\n<ul>\n<li>Add the following line immediately <tt>before</tt> the <tt>pam_unix.so</tt> statement in the <tt>AUTH</tt> section:\n<pre>auth required pam_faillock.so preauth silent deny=<sub idref=\"var_accounts_passwords_pam_faillock_deny\" /> unlock_time=<sub idref=\"var_accounts_passwords_pam_faillock_unlock_time\" /> fail_interval=<sub idref=\"var_accounts_passwords_pam_faillock_fail_interval\" /></pre></li>\n<li>Add the following line immediately <tt>after</tt> the <tt>pam_unix.so</tt> statement in the <tt>AUTH</tt> section:\n<pre>auth [default=die] pam_faillock.so authfail deny=<sub idref=\"var_accounts_passwords_pam_faillock_deny\" /> unlock_time=<sub idref=\"\
    var_accounts_passwords_pam_faillock_unlock_time\" /> fail_interval=<sub idref=\"var_accounts_passwords_pam_faillock_fail_interval\" /></pre></li>\n<li>Add the following line immediately <tt>before</tt> the <tt>pam_unix.so</tt> statement in the <tt>ACCOUNT</tt> section:\n<pre>account required pam_faillock.so</pre></li>\n</ul>"

rationale: |-
    By limiting the number of failed logon attempts the risk of unauthorized system
    access via user password guessing, otherwise known as brute-forcing, is reduced.
    Limits are imposed by locking the account.

severity: medium

identifiers:
    cce@rhel7: 27297-1

references:
    disa: 2238
    nist: AC-7(b)
    ospp@rhel7: FMT_MOF_EXT.1
    srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005
    stigid@rhel7: "010320"

ocil_clause: 'fail_interval is less than the required value'

ocil: "To ensure the failed password attempt policy is configured correctly, run the following command:\n<pre>$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth</pre>\nFor each file, the output should show <tt>fail_interval=&lt;interval-in-seconds&gt;</tt> where <tt>interval-in-seconds</tt> is \n<tt><sub idref=\"var_accounts_passwords_pam_faillock_fail_interval\" /></tt>  or greater. \nIf the <tt>fail_interval</tt> parameter is not set, the default setting of 900 seconds is acceptable."
