STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The Photon operating system must be configured to use the pam_faillock.so module.

DISA Rule

SV-258858r1210418_rule

Vulnerability Number

V-258858

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

PHTN-40-000192

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/pam.d/system-auth

Add or update the following lines making sure to place the preauth line before the pam_unix.so module:

auth required pam_faillock.so preauth
auth required pam_faillock.so authfail

Navigate to and open:

/etc/pam.d/system-account

Add or update the following lines making sure to place the line before the pam_unix.so module:

account required pam_faillock.so

Note: The lines shown assume the /etc/security/faillock.conf file is used to configure pam_faillock.

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.

Check Contents

At the command line, run the following commands to verify the pam_faillock.so module is used:

# grep '^auth' /etc/pam.d/system-auth

Example result:

auth required pam_faillock.so preauth
auth sufficient pam_unix.so
auth required pam_faillock.so authfail
auth optional pam_faildelay.so delay=4000000
auth required pam_deny.so

If the pam_faillock.so module is not present with the "preauth" line listed before pam_unix.so, this is a finding.

If the pam_faillock.so module is not present with the "authfail" line listed after pam_unix.so, this is a finding.

# grep '^account' /etc/pam.d/system-account

Example result:

account required pam_faillock.so
account required pam_unix.so

If the pam_faillock.so module is not present and listed before pam_unix.so, this is a finding.

Vulnerability Number

V-258858

Documentable

False

Rule Version

PHTN-40-000192

Severity Override Guidance

At the command line, run the following commands to verify the pam_faillock.so module is used:

# grep '^auth' /etc/pam.d/system-auth

Example result:

auth required pam_faillock.so preauth
auth sufficient pam_unix.so
auth required pam_faillock.so authfail
auth optional pam_faildelay.so delay=4000000
auth required pam_deny.so

If the pam_faillock.so module is not present with the "preauth" line listed before pam_unix.so, this is a finding.

If the pam_faillock.so module is not present with the "authfail" line listed after pam_unix.so, this is a finding.

# grep '^account' /etc/pam.d/system-account

Example result:

account required pam_faillock.so
account required pam_unix.so

If the pam_faillock.so module is not present and listed before pam_unix.so, this is a finding.

Check Content Reference

M

Target Key

5569