OL 9 must log username information when unsuccessful logon attempts occur.

Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.

Verify that OL 9 logs username information when unsuccessful logon attempts occur.

Verify the "/etc/security/faillock.conf" file is configured to log username information when unsuccessful logon attempts occur with the following command:

$ grep audit /etc/security/faillock.conf audit

If the "audit" option is not set, is missing, or is commented out, this is a finding.

Configure OL 9 to log username information when unsuccessful logon attempts occur.

Add/modify the "/etc/security/faillock.conf" file to match the following line:

audit