STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 30 Jan 2025:

The Photon operating system must automatically lock an account when three unsuccessful logon attempts occur.

DISA Rule

SV-256479r958388_rule

Vulnerability Number

V-256479

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

PHTN-30-000002

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
• CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/pam.d/system-auth

Remove any existing "pam_tally2.so" line and add the following line after the "pam_unix.so" statement:

auth required pam_tally2.so deny=3 onerr=fail audit even_deny_root unlock_time=900 root_unlock_time=300

Navigate to and open:

/etc/pam.d/system-account

Remove any existing "pam_tally2.so" line and add the following line after the "pam_unix.so" statement:

account required pam_tally2.so onerr=fail audit

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.

Check Contents

At the command line, run the following commands:

# grep pam_tally2 /etc/pam.d/system-auth

Expected result:

auth required pam_tally2.so deny=3 onerr=fail audit even_deny_root unlock_time=900 root_unlock_time=300

# grep pam_tally2 /etc/pam.d/system-account

Expected result:

account required pam_tally2.so onerr=fail audit

If the output does not list the "pam_tally2" options as configured in the expected results, this is a finding.

Vulnerability Number

V-256479

Documentable

False

Rule Version

PHTN-30-000002

Severity Override Guidance

At the command line, run the following commands:

# grep pam_tally2 /etc/pam.d/system-auth

Expected result:

auth required pam_tally2.so deny=3 onerr=fail audit even_deny_root unlock_time=900 root_unlock_time=300

# grep pam_tally2 /etc/pam.d/system-account

Expected result:

account required pam_tally2.so onerr=fail audit

If the output does not list the "pam_tally2" options as configured in the expected results, this is a finding.

Check Content Reference

M

Target Key

5520