CME-803
Account Lockout Policy (pam_faillock)
Description
Locks user accounts after a configurable number of failed authentication attempts, preventing online brute force attacks.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Brute force limited to N attempts before lockout |
CWE Relationships
Verification
Check pam_faillock configuration
$ grep faillock /etc/pam.d/system-auth
# Expected: pam_faillock.so
# Expected: pam_faillock.so
Platform: rhel
$ grep deny /etc/security/faillock.conf
# Expected: deny = 5
# Expected: deny = 5
Platform: rhel
$ net accounts | Select-String 'Lockout threshold'
# Expected: Lockout threshold 5
# Expected: Lockout threshold 5
Platform: windows
$ net accounts | Select-String 'Lockout duration'
# Expected: Lockout duration (minutes) 30
# Expected: Lockout duration (minutes) 30
Platform: windows
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |