documentation_complete: true

title: 'Set Password Retry Prompts Permitted Per-Session'

description: "To configure the number of retry prompts that are permitted per-session:\n<br /><br />\nEdit the <tt>pam_cracklib.so</tt> statement in <tt>/etc/pam.d/system-auth</tt> to \nshow <tt>retry=<sub idref=\"var_password_pam_retry\" /></tt>, or a lower value if site policy is more restrictive.\n<br /><br />\nThe DoD requirement is a maximum of 3 prompts per session."

rationale: |-
    Setting the password retry prompts that are permitted on a per-session basis to a low value
    requires some software, such as SSH, to re-connect. This can slow down and
    draw additional attention to some types of password-guessing attacks. Note that this
    is different from account lockout, which is provided by the pam_faillock module.

severity: unknown

identifiers:
    cce: 27123-9

references:
    disa: 1092
    nist: IA-5(c)

ocil_clause: 'it is not the required value'

ocil: |-
    To check how many retry attempts are permitted on a per-session basis, run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    The <tt>retry</tt> parameter will indicate how many attempts are permitted.
    The DoD required value is less than or equal to 3.
    This would appear as <tt>retry=3</tt>, or a lower value.
