Skip to content

Commit 3826eba

Browse files
Mab879Mab879
authored
Merge pull request #14678 from jan-cerny/issue14528
Allow both even_deny_root and root_unlock_time
2 parents e797706 + 3d456a4 commit 3826eba

22 files changed

Lines changed: 520 additions & 13 deletions

File tree

‎components/pam.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ rules:
6464
- accounts_passwords_pam_faillock_deny
6565
- accounts_passwords_pam_faillock_deny_root
6666
- accounts_passwords_pam_faillock_dir
67+
- accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
6768
- accounts_passwords_pam_faillock_enforce_local
6869
- accounts_passwords_pam_faillock_interval
6970
- accounts_passwords_pam_faillock_silent

‎controls/cis_fedora.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2083,7 +2083,8 @@ controls:
20832083
- l2_workstation
20842084
status: automated
20852085
rules:
2086-
- accounts_passwords_pam_faillock_deny_root
2086+
- accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
2087+
- var_accounts_passwords_pam_faillock_root_unlock_time=60
20872088

20882089
- id: 5.3.3.2.1
20892090
title: Ensure password number of changed characters is configured (Automated)

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/ansible/shared.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# platform = multi_platform_rhel,multi_platform_fedora
2+
# reboot = false
3+
# strategy = restrict
4+
# complexity = low
5+
# disruption = low
6+
{{{ ansible_pam_faillock_enable(rule_title=rule_title) }}}
7+
{{{ ansible_pam_faillock_parameter_value("even_deny_root", "", rule_title=rule_title) }}}

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/bash/shared.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# platform = multi_platform_rhel,multi_platform_fedora
2+
3+
{{{ bash_pam_faillock_enable() }}}
4+
{{{ bash_pam_faillock_parameter_value("even_deny_root", "") }}}

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/oval/shared.xml‎

Lines changed: 379 additions & 0 deletions
Large diffs are not rendered by default.

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/rule.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
documentation_complete: true
2+
3+
title: Ensure Root Account Lockout on Failed Password Attempts
4+
5+
description: >-
6+
This rule configures the system to include the <tt>root</tt> account in the
7+
account lockout policy using <tt>pam_faillock.so</tt>. The system must have
8+
either the <tt>even_deny_root</tt> option enabled or <tt>root_unlock_time</tt>
9+
set to <tt>{{{xccdf_value("var_accounts_passwords_pam_faillock_root_unlock_time") }}}</tt>
10+
seconds or greater in <tt>{{{ pam_faillock_conf_path }}}</tt>.
11+
12+
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
13+
defined to work as expected. In order to avoid errors when manually editing these files, it is
14+
recommended to use the appropriate tools, such as <tt>authselect</tt> or <tt>authconfig</tt>,
15+
depending on the OS version.
16+
17+
rationale: >-
18+
By limiting the number of failed logon attempts, the risk of unauthorized system access via
19+
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
20+
the account.
21+
22+
severity: medium
23+
24+
identifiers:
25+
cce@rhel8: CCE-86629-3
26+
cce@rhel9: CCE-86630-1
27+
cce@rhel10: CCE-86631-9
28+
29+
platform: package[pam]
30+
31+
ocil_clause: 'neither "even_deny_root" is set nor "root_unlock_time" is set to {{{ xccdf_value("var_accounts_passwords_pam_faillock_root_unlock_time") }}} or greater'
32+
33+
ocil: >-
34+
Verify {{{ full_name }}} is configured to include the root account in the account lockout
35+
policy with the command:
36+
37+
<pre>$ grep -E 'even_deny_root|root_unlock_time' {{{ pam_faillock_conf_path }}}</pre>
38+
39+
The output should show either:
40+
<pre>even_deny_root</pre>
41+
or:
42+
<pre>root_unlock_time = &lt;value&gt;</pre>
43+
where <tt>&lt;value&gt;</tt> is <tt>{{{ xccdf_value("var_accounts_passwords_pam_faillock_root_unlock_time") }}}</tt> or greater.
44+
45+
warnings:
46+
- general: >-
47+
If the system relies on <tt>authselect</tt> tool to manage PAM settings, the remediation
48+
will also use <tt>authselect</tt> tool. However, if any manual modification was made in
49+
PAM files, the <tt>authselect</tt> integrity check will fail and the remediation will be
50+
aborted in order to preserve intentional changes. In this case, an informative message will
51+
be shown in the remediation report.
52+
If the system supports the <tt>{{{ pam_faillock_conf_path }}}</tt> file, the pam_faillock
53+
parameters should be defined in <tt>faillock.conf</tt> file.

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/tests/even_deny_root_faillock_conf.pass.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
# packages = authselect
3+
# platform = multi_platform_rhel,multi_platform_fedora
4+
# variables = var_accounts_passwords_pam_faillock_root_unlock_time=60
5+
6+
authselect select sssd --force
7+
authselect enable-feature with-faillock
8+
> "{{{ pam_faillock_conf_path }}}"
9+
echo "even_deny_root" >> "{{{ pam_faillock_conf_path }}}"
10+
echo "silent" >> "{{{ pam_faillock_conf_path }}}"

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/tests/neither_set_faillock_conf.fail.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
# packages = authselect
3+
# platform = multi_platform_rhel,multi_platform_fedora
4+
# variables = var_accounts_passwords_pam_faillock_root_unlock_time=60
5+
6+
authselect select sssd --force
7+
authselect enable-feature with-faillock
8+
> "{{{ pam_faillock_conf_path }}}"
9+
echo "silent" >> "{{{ pam_faillock_conf_path }}}"

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/tests/pam_faillock_disabled.fail.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
# packages = authselect
3+
# platform = multi_platform_rhel,multi_platform_fedora
4+
# variables = var_accounts_passwords_pam_faillock_root_unlock_time=60
5+
6+
authselect select sssd --force
7+
authselect disable-feature with-faillock

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time/tests/root_unlock_time_300_faillock_conf.pass.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
# packages = authselect
3+
# platform = multi_platform_rhel,multi_platform_fedora
4+
# variables = var_accounts_passwords_pam_faillock_root_unlock_time=60
5+
6+
authselect select sssd --force
7+
authselect enable-feature with-faillock
8+
> "{{{ pam_faillock_conf_path }}}"
9+
echo "root_unlock_time = 300" >> "{{{ pam_faillock_conf_path }}}"
10+
echo "silent" >> "{{{ pam_faillock_conf_path }}}"

0 commit comments

Comments
 (0)