The Photon operating system must audit logon attempts for unknown users.

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

At the command line, run the following command to verify that audit logon attempts for unknown users is performed:

# grep '^audit' /etc/security/faillock.conf

Example result:

audit

If the "audit" option is not set, is missing or commented out, this is a finding.

Note: If faillock.conf is not used to configure pam_faillock.so then these options may be specified on the faillock lines in the system-auth and system-account files.

Navigate to and open:

/etc/security/faillock.conf

Add or update the following lines:

audit

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.