RHEL 10 must log username information when unsuccessful login attempts occur.

Without auditing of these events, it may be harder or impossible to identify what an attacker did after an attack.

Verify RHEL 10 "/etc/security/faillock.conf" is configured to log username information when unsuccessful login attempts occur with the following command:

$ sudo grep audit /etc/security/faillock.conf audit

If the "audit" option is not set, is missing, or is commented out, this is a finding.

Configure RHEL 10 to log username information when unsuccessful login attempts occur.

Enable the feature using the following command:

$ sudo authselect enable-feature with-faillock

Add/modify the "/etc/security/faillock.conf" file to match the following line:

audit