STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must be configured to enforce the limit of three consecutive invalid login attempts, after which time it must block any login attempt for 15 minutes.

DISA Rule

SV-268227r1038750_rule

Vulnerability Number

V-268227

Group Title

SRG-APP-000065-NDM-000214

Rule Version

HYCU-ND-000090

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Log in to the server virtual console and navigate to the "/etc/pam.d/" folder.

Move the current configuration and make new copies to be edited by executing the following commands:

sudo cp password-auth password-auth-as

sudo cp system-auth system-auth-as

Edit the files "password-auth" and "system-auth".

Add the lines:
auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=60 unlock_time=900
after line
auth required pam_env.so

Add:
auth required pam_faillock.so authfail audit unlock_time=900
after
auth sufficient pam_unix.so nullok

Add:
account required pam_faillock.so
before
account required pam_unix.so

The files "system-auth" and "password-auth" are identical, so the procedure can be done on one of the files and copied to the second one.

Restart sssd service:
sudo systemctl restart sssd.service

Check Contents

Log in to the HYCU VM console and go to the "/etc/pam.d/" folder. Verify that "password-auth" and "system-auth" contain the following three lines, and the values for deny and unlock_time are as shown.

Commands:
sudo grep pam_faillock.so /etc/pam.d/password-auth
sudo grep pam_faillock.so /etc/pam.d/system-auth

Both should displays the following three lines:
auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=60 unlock_time=900
auth required pam_faillock.so authfail audit unlock_time=900
account required pam_faillock.so

If the required content is not present, this is a finding.

Vulnerability Number

V-268227

Documentable

False

Rule Version

HYCU-ND-000090

Severity Override Guidance

Log in to the HYCU VM console and go to the "/etc/pam.d/" folder. Verify that "password-auth" and "system-auth" contain the following three lines, and the values for deny and unlock_time are as shown.

Commands:
sudo grep pam_faillock.so /etc/pam.d/password-auth
sudo grep pam_faillock.so /etc/pam.d/system-auth

Both should displays the following three lines:
auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=60 unlock_time=900
auth required pam_faillock.so authfail audit unlock_time=900
account required pam_faillock.so

If the required content is not present, this is a finding.

Check Content Reference

M

Target Key

5660