AlmaLinux OS 9 must automatically lock an account when three unsuccessful logon attempts occur.

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Verify AlmaLinux OS 9 is configured to lock an account after three unsuccessful logon attempts with the command:

$ grep deny /etc/security/faillock.conf

deny = 3

If the "deny" option is not set to 3 or less (but not 0), is missing or commented out, this is a finding.

Configure AlmaLinux OS 9 to lock an account when three unsuccessful logon attempts occur using pam_faillock.

First, enable the feature using the following command:

$ authselect enable-feature with-faillock

Then, add or update the following line in the "/etc/security/faillock.conf" file:

deny = 3