Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set Lockouts for Failed Password Attempts - False Positives #11200

Closed
hborrel opened this issue Oct 13, 2023 · 0 comments · Fixed by #11205
Closed

Set Lockouts for Failed Password Attempts - False Positives #11200

hborrel opened this issue Oct 13, 2023 · 0 comments · Fixed by #11205
Labels
CIS CIS Benchmark related. Ubuntu Ubuntu product related.

Comments

@hborrel
Copy link

hborrel commented Oct 13, 2023

The following tests were failing on a new build of Ubuntu 22.04. Faillock tests confirmed that the configuration was working.
- Lock Accounts After Failed Password Attempts
- Set Interval For Counting Failed Password Attempts
- Set Lockout Time for Failed Password Attempts

Description of problem:

During troubleshooting we found that "Check common definition of pam_faillock.so in account section of common-account" was failing the evaluation
This was due to whitespace at the end of the line

The remediation script did not fix the issue because of regex used.
if ! grep -qE '^\s*account\s+required\s+pam_faillock.so.*$' "$pam_file"

Proposed change:

Currently
ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex is defined as
^\s*account\s+required\s+pam_faillock.so$

This change would resolve resolve the issue
^\s*account\s+required\s+pam_faillock.so\s*$

@hborrel hborrel added the enhancement General enhancements to the project. label Oct 13, 2023
@dodys dodys added Ubuntu Ubuntu product related. CIS CIS Benchmark related. and removed enhancement General enhancements to the project. labels Oct 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CIS CIS Benchmark related. Ubuntu Ubuntu product related.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants