Check: AZLX-23-002460
Amazon Linux 2023 STIG:
AZLX-23-002460
(in version v1 r1)
Title
Amazon Linux 2023 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. (Cat II impact)
Discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.
Check Content
Verify Amazon Linux 2023 is configured to lock the root account after three unsuccessful logon attempts with the command: $ grep even_deny_root /etc/security/faillock.conf even_deny_root If the "even_deny_root" option is not set, is missing or commented out, this is a finding.
Fix Text
Configure Amazon Linux 2023 to lock out the "root" account after a number of incorrect login attempts using "pam_faillock.so", first enable the feature using the following command: $ sudo authselect enable-feature with-faillock Then edit the "/etc/security/faillock.conf" file as follows: add or uncomment the following line: even_deny_root
Additional Identifiers
Rule ID: SV-274155r1120453_rule
Vulnerability ID: V-274155
Group Title: SRG-OS-000329-GPOS-00128
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002238 |
Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded. |
Controls
| Number | Title |
|---|---|
| AC-7 |
Unsuccessful Logon Attempts |