The Photon operating system must persist lockouts between system reboots.

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

By default, account lockout information is stored under /var/run/faillock and is not persistent between reboots.

At the command line, run the following command to verify account locking persists lockouts between system reboots

# grep '^dir' /etc/security/faillock.conf

Example result:

dir = /var/log/faillock

If the "dir" option is set to "/var/run/faillock", this is a finding. If the "dir" option is not set to a persistent documented faillock directory, is missing or commented out, this is a finding.

Note: If faillock.conf is not used to configure pam_faillock.so, these options may be specified on the faillock lines in the system-auth and system-account files.

Navigate to and open:

/etc/security/faillock.conf

Add or update the following lines:

dir = /var/log/faillock

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.