STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

TOSS must enforce the limit of five consecutive invalid logon attempts by a user during a 15-minute time period.

DISA Rule

SV-252946r1190835_rule

Vulnerability Number

V-252946

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

TOSS-04-020000

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Configure the operating system to lock an account when three unsuccessful logon attempts occur in 15 minutes.

Add/Modify the "/etc/security/faillock.conf" file to match the following lines:

deny = 3
fail_interval = 900

Check Contents

Verify the "/etc/security/faillock.conf" file is configured to lock an account after three unsuccessful logon attempts within 15 minutes:

$ sudo grep -e "deny =" -e "fail_interval =" /etc/security/faillock.conf
deny = 3
fail_interval = 900

If the "deny" option is set to "0", more than "3", is missing, or is commented out, this is a finding.
If the "fail_interval" option is set to less than "900", is missing, or is commented out, this is a finding.

Vulnerability Number

V-252946

Documentable

False

Rule Version

TOSS-04-020000

Severity Override Guidance

Verify the "/etc/security/faillock.conf" file is configured to lock an account after three unsuccessful logon attempts within 15 minutes:

$ sudo grep -e "deny =" -e "fail_interval =" /etc/security/faillock.conf
deny = 3
fail_interval = 900

If the "deny" option is set to "0", more than "3", is missing, or is commented out, this is a finding.
If the "fail_interval" option is set to less than "900", is missing, or is commented out, this is a finding.

Check Content Reference

M

Target Key

5469