BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-09-611030 RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

DISA STIG library V2R10
All changes in this version
first version loaded CAT II

Maps to AC-7 via CCI-000044

Title

RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.

Control

Verify the pam_faillock.so module is present in the "/etc/pam.d/system-auth" file: $ grep pam_faillock.so /etc/pam.d/system-auth auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so If the pam_faillock.so module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before pam_unix.so, this is a finding. If the system administrator (SA) can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the system-auth file, this is not a finding.

Discussion

If the pam_faillock.so module is not loaded, the system will not correctly lockout accounts to prevent password guessing attacks.

Related controls

CCI-000044

Fix

Configure RHEL 9 to include the use of the pam_faillock.so module in the /etc/pam.d/system-auth file. If PAM is managed with authselect, enable the feature with the following command: $ sudo authselect enable-feature with-faillock Otherwise, add/modify the appropriate sections of the "/etc/pam.d/system-auth" file to match the following lines: Note: The "preauth" line must be listed before pam_unix.so. auth required pam_faillock.so preauth auth required pam_faillock.so authfail account required pam_faillock.so