documentation_complete: true

prodtype: rhel7

title: 'Ensure the Logon Failure Delay is Set Correctly in login.defs'

description: |-
    To ensure the logon failure delay controlled by <tt>/etc/login.defs</tt> is set properly,
    add or correct the <tt>FAIL_DELAY</tt> setting in <tt>/etc/login.defs</tt> to read as follows:
    <pre>FAIL_DELAY <sub idref="var_accounts_fail_delay" /></pre>

rationale: |-
    Increasing the time between a failed authentication attempt and re-prompting to
    enter credentials helps to slow a single-threaded brute force attack.

severity: unknown

identifiers:
    cce@rhel7: 80352-8

references:
    disa: 366
    nist: CM-6(b)
    srg: SRG-OS-000480-GPOS-00226
    stigid@rhel7: "010430"

ocil_clause: 'the above command returns no output, or FAIL_DELAY is configured less than the expected value'

ocil: |-
    Verify the <tt>FAIL_DELAY</tt> setting is configured correctly in the <tt>/etc/login.defs</tt> file by
    running the following command:
    <pre>$ sudo grep -i "FAIL_DELAY" /etc/login.defs</pre>
    All output must show the value of <tt>FAIL_DELAY</tt> set as shown in the below:
    <pre>$ sudo grep -i "FAIL_DELAY" /etc/login.defs
    fail_delay <sub idref="var_accounts_fail_delay" /></pre>
