fa657903bc
This patch applies pam_faillock restrictions to Red Hat and CentOS servers. It's an optional change since it could cause issues with existing production deployments. Ubuntu doesn't have pam_faillock, but it may be possible to use fail2ban to achieve some of the same goals later. Documentation is included. Implements: blueprint security-rhel7-stig Change-Id: Ib2d22deff2d97786b84a550313f6ca08cf10cef8
4 lines
678 B
Django/Jinja
4 lines
678 B
Django/Jinja
# RHEL-07-010371 - If three unsuccessful logon attempts within 15 minutes occur the associated account must be locked.
|
|
auth required pam_faillock.so preauth silent audit deny="{{ security_pam_faillock_attempts }}" "{{ security_pam_faillock_deny_root | bool | ternary('even_deny_root','') }}" fail_interval="{{ security_pam_faillock_interval }}" unlock_time="{{ security_pam_faillock_unlock_time }}"
|
|
auth [default=die] pam_faillock.so authfail audit deny="{{ security_pam_faillock_attempts }}" "{{ security_pam_faillock_deny_root | bool | ternary('even_deny_root','') }}" fail_interval="{{ security_pam_faillock_interval }}" unlock_time="{{ security_pam_faillock_unlock_time }}"
|