Ensure lockout for failed password attempts is configured

점검 방법

감사 방식: 셸 명령

bad=0; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do l=$(grep -P "^\h*auth\h+[^#\n\r]+\h+pam_faillock\.so\s+" $p 2>/dev/null); [ -n "$l" ] || { bad=1; continue; }; for d in $(printf "%s\n" "$l" | grep -oP "deny=\K[0-9]+"); do [ "$d" -ge 1 ] && [ "$d" -le 5 ] || bad=1; done; for u in $(printf "%s\n" "$l" | grep -oP "unlock_time=\K[0-9]+"); do [ "$u" -eq 0 ] || [ "$u" -ge 900 ] || bad=1; done; printf "%s\n" "$l" | grep -q "deny=" || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set password lockouts and unlock times to conform to site policy. deny should be not greater than 5 and unlock_time should be 0 (never), or 900 seconds or greater. Edit the files /etc/pam.d/system-auth and /etc/pam.d/system-password and add the following lines: Modify the deny= and unlock_time= parameters to conform to local site policy, Not to be greater than deny=5: Add the following lines to the auth section: auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900 auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 The auth sections should look similar to the following example: Note: The ordering on the lines in the auth section is important. The preauth line needs to below the line auth required pam_env.so and above all password validation lines. ...

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target azure-container-linux