STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user automatically locks the account until released by an administrator.

DISA Rule

SV-219166r610963_rule

Vulnerability Number

V-219166

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

UBTU-18-010033

Severity

CAT II

CCI(s)

• CCI-000044 - The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
• CCI-002238 - The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts.

Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the "auth" stack. So add the following line before the first "auth" entry in the file.

auth required pam_tally2.so onerr=fail deny=3

Check Contents

Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command:

# grep pam_tally2 /etc/pam.d/common-auth

auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.
If the line is missing "onerr=fail", this is a finding.
If the line has "deny" set to a value more than 3, this is a finding.

Vulnerability Number

V-219166

Documentable

False

Rule Version

UBTU-18-010033

Severity Override Guidance

Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command:

# grep pam_tally2 /etc/pam.d/common-auth

auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.
If the line is missing "onerr=fail", this is a finding.
If the line has "deny" set to a value more than 3, this is a finding.

Check Content Reference

M

Target Key

4055

Comments