Lock Out After Three Consecutive Invalid Logon Attempts

The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user locks the account.

Rationale:

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Audit:

Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command:

grep pam_tally2 /etc/pam.d/common-auth

auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.
If the line is missing "onerr=fail", this is a finding.
If the line has "deny" set to a value more than 3, this is a finding.

Remediation:

Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts.

Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the auth stack. So add the following line before the first auth entry in the file.

auth required pam_tally2.so onerr=fail deny=3