bug: deny_password_attempts* seems broken

Paul Tittle (Contractor) ptittle at cmf.nrl.navy.mil
Thu Sep 5 18:26:26 UTC 2013


Using deny_password_attempts as an example, it says:

Add the following lines immediately below the|pam_unix.so|statement 
in|AUTH|section of|/etc/pam.d/system-auth|:

|auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900|

|auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900|


-----------

Looking at input/checks/accounts_passwords_pam_faillock_deny.xml , 
accounts_passwords_pam_faillock_deny seems to test for the bottom line 
in /etc/pam.d/system-auth and the top line in /etc/pam.d/password-auth, 
but password-auth is not mentioned in the deny_password_attempts 
description.

For the other two deny_password_attempts tests, it's a similar 
situation. Is the test wrong or the description wrong?

Thanks,
Paul



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130905/df7cb82a/attachment.html>


More information about the scap-security-guide mailing list