STIGQter STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system must lock an account after three consecutive invalid access attempts.

DISA Rule

SV-217114r603262_rule

Vulnerability Number

V-217114

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

SLES-12-010130

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the operating system to lock an account when three unsuccessful access attempts occur.

Modify the first line of the auth section "/etc/pam.d/common-auth" file to match the following lines:

auth required pam_tally2.so onerr=fail silent audit deny=3

Add or modify the following line in the /etc/pam.d/common-account file:
account required pam_tally2.so

Note: Manual changes to the listed files may be overwritten by the "pam-config" program. The "pam-config" program should not be used to update the configurations listed in this requirement.

Check Contents

Verify the SUSE operating system locks a user account after three consecutive failed access attempts until the locked account is released by an administrator.

Check that the system locks a user account after three consecutive failed login attempts using the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.

If the line is missing "onerr=fail", this is a finding.

If the line has "deny" set to a value other than 1, 2, or 3, this is a finding.

Check that the system resets the failed login attempts counter after a successful login using the following command:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the account option is missing, or commented out, this is a finding.

Vulnerability Number

V-217114

Documentable

False

Rule Version

SLES-12-010130

Severity Override Guidance

Verify the SUSE operating system locks a user account after three consecutive failed access attempts until the locked account is released by an administrator.

Check that the system locks a user account after three consecutive failed login attempts using the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.

If the line is missing "onerr=fail", this is a finding.

If the line has "deny" set to a value other than 1, 2, or 3, this is a finding.

Check that the system resets the failed login attempts counter after a successful login using the following command:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the account option is missing, or commented out, this is a finding.

Check Content Reference

M

Target Key

4033

Comments