Ensure lockout for failed password attempts is configured

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

bad=0; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do l=$(grep -P "^\h*auth\h+[^#\n\r]+\h+pam_faillock\.so\s+" $p 2>/dev/null); [ -n "$l" ] || { bad=1; continue; }; for d in $(printf "%s\n" "$l" | grep -oP "deny=\K[0-9]+"); do [ "$d" -ge 1 ] && [ "$d" -le 5 ] || bad=1; done; for u in $(printf "%s\n" "$l" | grep -oP "unlock_time=\K[0-9]+"); do [ "$u" -eq 0 ] || [ "$u" -ge 900 ] || bad=1; done; printf "%s\n" "$l" | grep -q "deny=" || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Set password lockouts and unlock times to conform to site policy. deny should be not greater than 5 and unlock_time should be 0 (never), or 900 seconds or greater. Edit the files /etc/pam.d/system-auth and /etc/pam.d/system-password and add the following lines: Modify the deny= and unlock_time= parameters to conform to local site policy, Not to be greater than deny=5: Add the following lines to the auth section: auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900 auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 The auth sections should look similar to the following example: Note: The ordering on the lines in the auth section is important. The preauth line needs to below the line auth required pam_env.so and above all password validation lines. ...

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target azure-container-linux