STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system must lock an account after three consecutive invalid access attempts.

DISA Rule

SV-217114r603262_rule

Vulnerability Number

V-217114

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

SLES-12-010130

Severity

CAT II

CCI(s)

• CCI-000044 - The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Configure the operating system to lock an account when three unsuccessful access attempts occur.

Modify the first line of the auth section "/etc/pam.d/common-auth" file to match the following lines:

auth required pam_tally2.so onerr=fail silent audit deny=3

Add or modify the following line in the /etc/pam.d/common-account file:
account required pam_tally2.so

Note: Manual changes to the listed files may be overwritten by the "pam-config" program. The "pam-config" program should not be used to update the configurations listed in this requirement.

Check Contents

Verify the SUSE operating system locks a user account after three consecutive failed access attempts until the locked account is released by an administrator.

Check that the system locks a user account after three consecutive failed login attempts using the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.

If the line is missing "onerr=fail", this is a finding.

If the line has "deny" set to a value other than 1, 2, or 3, this is a finding.

Check that the system resets the failed login attempts counter after a successful login using the following command:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the account option is missing, or commented out, this is a finding.

Vulnerability Number

V-217114

Documentable

False

Rule Version

SLES-12-010130

Severity Override Guidance

Verify the SUSE operating system locks a user account after three consecutive failed access attempts until the locked account is released by an administrator.

Check that the system locks a user account after three consecutive failed login attempts using the following command:

# grep pam_tally2.so /etc/pam.d/common-auth
auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.

If the line is missing "onerr=fail", this is a finding.

If the line has "deny" set to a value other than 1, 2, or 3, this is a finding.

Check that the system resets the failed login attempts counter after a successful login using the following command:

# grep pam_tally2.so /etc/pam.d/common-account
account required pam_tally2.so

If the account option is missing, or commented out, this is a finding.

Check Content Reference

M

Target Key

4033

Comments