CME-803

Account Lockout Policy (pam_faillock)

Harden Identity Unquantified evidence Preventive

Description

Lock user accounts after a configurable number of consecutive failed authentication attempts, preventing online brute force and dictionary attacks. On Linux, pam_faillock (RHEL 8+) or pam_tally2 (legacy) tracks per-user authentication failures and locks the account when the threshold is reached. Key parameters: deny (max failed attempts, typically 5), unlock_time (lockout duration in seconds, typically 900), and fail_interval (window for counting failures). With deny=5 and unlock_time=900, brute force is rate-limited to approximately 20 attempts per hour per account, making password guessing computationally infeasible against any password meeting basic quality requirements. On Windows, equivalent policy is configured via Group Policy (Account Lockout Policy) or Fine-Grained Password Policies. Does not protect against password spraying (one password across many accounts) or credential stuffing with breached passwords — those require complementary controls like IP-based rate limiting and credential breach monitoring.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Without lockout, an attacker can make unlimited authentication attempts against a login interface (SSH, RDP, web console), enabling dictionary attacks and brute force with tools like Hydra or Medusa. With pam_faillock configured (deny=5, unlock_time=900), authentication is rate-limited to approximately 20 attempts per hour per account — making brute force of any password meeting basic quality requirements computationally infeasible. The attacker must find an alternative authentication bypass rather than simply guessing credentials. Note: per-account lockout does not prevent password spraying (one password across many accounts) or cause attacker-triggered denial-of-service by deliberately locking accounts — complementary controls (IP-based rate limiting, spray detection) address those scenarios

CWE Relationships

CWE-307

Verification

Verify account lockout enforcement via pam_faillock (Linux) or Group Policy (Windows)

$ grep -rE 'pam_faillock|pam_tally2' /etc/pam.d/system-auth /etc/pam.d/common-auth 2>/dev/null | grep -c 'auth'
# Expected: >=1

Platform: linux

$ grep '^deny' /etc/security/faillock.conf
# Expected: deny = 5

Platform: linux

$ net accounts | Select-String 'Lockout threshold'
# Expected: Lockout threshold 5

Platform: windows

$ net accounts | Select-String 'Lockout duration'
# Expected: Lockout duration (minutes) 30

Platform: windows

Remediation

linux pam_faillock account lockout via faillock.conf


printf 'deny = 5
unlock_time = 900
fail_interval = 900
even_deny_root
root_unlock_time = 60
dir = /var/run/faillock
audit
silent
' > /etc/security/faillock.conf
authselect enable-feature with-faillock 2>/dev/null || grep -q pam_faillock /etc/pam.d/system-auth

windows Windows account lockout policy via net accounts


net accounts /lockoutthreshold:5
net accounts /lockoutduration:30
net accounts /lockoutwindow:30

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
redhat	enterprise_linux	`cpe:2.3:o:redhat:enterprise_linux:8:::::::` `cpe:2.3:o:redhat:enterprise_linux:9:::::::` `cpe:2.3:o:redhat:enterprise_linux:10:::::::*`	All	applicable
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable