V-285661

Discussion

Failure to limit consecutive unsuccessful authentication attempts may allow attackers to conduct password guessing or brute force attacks against operating system accounts. Account lockout mechanisms reduce the likelihood of unauthorized access by restricting repeated authentication failures and increasing resistance to automated credential attacks. Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128, SRG-OS-000480-GPOS-00225, SRG-OS-000710-GPOS-00160

Check Content

Verify Harvester Government enforces account lockout after a defined number of consecutive unsuccessful authentication attempts.

1. Access Harvester Government using a privileged account and review the PAM authentication configuration:

grep "pam_tally2.so" /etc/pam.d/common-auth
grep "pam_tally2.so" /etc/pam.d/common-account

2. Verify the PAM configuration includes "pam_tally2.so" and contains the following parameter:

deny=3

If "pam_tally2.so" is absent from the PAM configuration, and "deny=3" is not configured, is commented out, or is configured with a value other than the approved baseline, this is a finding.

If the account module configuration does not reference "pam_tally2.so", this is a finding.