STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must lock an account after three consecutive invalid access attempts.

DISA Rule

SV-261364r996863_rule

Vulnerability Number

V-261364

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

SLEM-05-412020

Severity

CAT II

CCI(s)

CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

Fix Recommendation

Configure SLEM 5 to lock an account when three unsuccessful access attempts occur.

Note: Manual changes to the listed files may be overwritten by the "pam-config" program. The "pam-config" program should not be used to update the configurations listed in this requirement.

Add or modify the first line of the auth section in the "/etc/pam.d/common-auth" file to match the following line:

auth required pam_tally2.so onerr=fail silent audit deny=3

Add or modify the following line in the "/etc/pam.d/common-account" file:

account required pam_tally2.so

Check Contents

Verify SLEM 5 locks a user account after three consecutive failed access attempts until the locked account is released by an administrator with the following command:

> grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so onerr=fail deny=3

If "deny" set to a value other than "1", "2", or "3", if "onerr=fail" is missing, if the line is commented out, or the line is missing, this is a finding.

Vulnerability Number

V-261364

Documentable

False

Rule Version

SLEM-05-412020

Severity Override Guidance

Check Content Reference

Target Key

5596