STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020: Accounts on the SUSE operating system that are subject to three unsuccessful logon attempts within 15 minutes must be locked for the maximum configurable period.

DISA Rule

SV-96423r3_rule

Vulnerability Number

V-81709

Group Title

SRG-OS-000329-GPOS-00128

Rule Version

SLES-12-010131

Severity

CAT II

CCI(s)

• CCI-002238 - The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.

Modify the first three lines of the auth section "/etc/pam.d/common-auth" file to match the following lines:

auth required pam_tally2.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
auth sufficient pam_unix.so try_first_pass
auth [default=die] pam_tally2.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900

Add or modify the following line in the /etc/pam.d/common-account file:
account required pam_tally2.so

Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.

Check Contents

Verify the operating system automatically locks an account for the maximum period for which the system can be configured.

Check that the system locks an account for the maximum period after three unsuccessful logon attempts within a period of 15 minutes with the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
auth [default=die] pam_tally2.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900

If the "unlock_time" parameter is not set to "0", "never", or is set to a value less than "900" on both "auth" lines with the "pam_tally2.so" module, or is missing from these lines, this is a finding.
Note: The maximum configurable value for "unlock_time" is "604800".

Verify that "pam_tally2.so" is configured for all accounts:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the above line is missing or is commented out, this is a finding.

Vulnerability Number

V-81709

Documentable

False

Rule Version

SLES-12-010131

Severity Override Guidance

Verify the operating system automatically locks an account for the maximum period for which the system can be configured.

Check that the system locks an account for the maximum period after three unsuccessful logon attempts within a period of 15 minutes with the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
auth [default=die] pam_tally2.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900

If the "unlock_time" parameter is not set to "0", "never", or is set to a value less than "900" on both "auth" lines with the "pam_tally2.so" module, or is missing from these lines, this is a finding.
Note: The maximum configurable value for "unlock_time" is "604800".

Verify that "pam_tally2.so" is configured for all accounts:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the above line is missing or is commented out, this is a finding.

Check Content Reference

M

Target Key

2903

Comments