>From 6b3cfb6e41ddaab2f375b68af3cb93968a947664 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 31 Jan 2013 09:49:58 -0500 Subject: [PATCH] [bugfix] var_accounts_passwords_pam_faillock_unlock_time value exceeded MAX_TIME_INTERVAL As reported by Philip S., the 100000000 value for var_accounts_passwords_pam_faillock_unlock_time exceeded the MAX_TIME_INTERVAL value of which PAM would accept. Updated the selector values within pam.xml, r/unlock_time=100000000/unlock_time=604800/g within the XCCDF content, updated the profiles which also used var_accounts_passwords_pam_faillock_unlock_time. --- RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL6/input/profiles/stig-rhel6-server.xml | 2 +- RHEL6/input/system/accounts/pam.xml | 16 ++++++++-------- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index 3c5c465..9bbb86b 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -67,7 +67,7 @@ assurance." - 1800 (30 minutes) - 3600 (1 hour) - 86400 (1 day) - - 100000000 (3.1 years) --> + - 604800 (7 days) --> 1800 3600 86400 -100000000 +604800 @@ -396,8 +396,8 @@ To configure the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=100000000 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=100000000 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
+
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
To ensure the failed password attempt policy is configured correctly, run the following command: @@ -420,8 +420,8 @@ To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=100000000 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=100000000 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
+
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
To ensure the failed password attempt policy is configured correctly, run the following command: @@ -446,8 +446,8 @@ To configure the system to lock out accounts after a number of incorrect login attempts within a 15 minute interval using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=100000000 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=100000000 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
+
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
To ensure the failed password attempt policy is configured correctly, run the following command: -- 1.7.1