documentation_complete: true

prodtype: rhel7

title: 'Configure the <tt>root</tt> Account for Failed Password Attempts'

description: "To configure the system to lock out the <tt>root</tt> account after a number of incorrect login\nattempts using <tt>pam_faillock.so</tt>, modify the content of both\n<tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt> as follows:\n<br /><br />\n<ul> \n<li>Modify the following line in the <tt>AUTH</tt> section to add <tt>even_deny_root</tt>:\n<pre>auth required pam_faillock.so preauth silent <b>even_deny_root</b> deny=<sub idref=\"var_accounts_passwords_pam_faillock_deny\" /> unlock_time=<sub idref=\"var_accounts_passwords_pam_faillock_unlock_time\" /> fail_interval=<sub idref=\"var_accounts_passwords_pam_faillock_fail_interval\" /></pre></li>\n<li>Modify the following line in the <tt>AUTH</tt> section to add <tt>even_deny_root</tt>:\n<pre>auth [default=die] pam_faillock.so authfail <b>even_deny_root</b> deny=<sub idref=\"var_accounts_passwords_pam_faillock_deny\" /> unlock_time=<sub idref=\"var_accounts_passwords_pam_faillock_unlock_time\" /> fail_interval=<sub\
    \ idref=\"var_accounts_passwords_pam_faillock_fail_interval\" /></pre></li>\n</ul>"

rationale: |-
    By limiting the number of failed logon attempts, the risk of unauthorized system access via user password
    guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

severity: medium

identifiers:
    cce@rhel7: 80353-6

references:
    disa: 2238
    nist: AC-7(b)
    ospp@rhel7: FMT_MOF_EXT.1
    srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005
    stigid@rhel7: "010330"

ocil_clause: 'that is not the case'

ocil: |-
    To ensure that even the <tt>root</tt> account is locked after a defined number of failed password
    attempts, run the following command:
    <pre>$ grep even_deny_root /etc/pam.d/system-auth</pre>
    The output should show <tt>even_deny_root</tt>.
