TOSS 5 must automatically lock an account when three unsuccessful login attempts occur.

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128

Verify TOSS 5 is configured to lock an account after three unsuccessful login attempts using the command:

$ grep 'deny =' /etc/security/faillock.conf

deny = 3

If the "deny" option is not set to "3" or less (but not "0"), is missing or commented out, this is a finding.

Configure TOSS 5 to lock an account when three unsuccessful login attempts occur.

Add or modify the "/etc/security/faillock.conf" file to match the following line:

deny = 3