# Ensure password failed attempts lockout is configured

The `pam_faillock` module is a critical security control that locks user accounts after a specified number of consecutive failed login attempts. This functionality is essential for mitigating brute-force or dictionary-based password guessing attacks, which are common methods used by adversaries to gain unauthorized access. A system without this protection is highly vulnerable to such attacks. The audit script inspects the core PAM configuration files (`/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`) to confirm that `pam_faillock` is correctly integrated into the authentication stack. The remediation script leverages the system's standard `authconfig` utility to enable or disable the lockout policy, ensuring the changes are applied safely and correctly. The recommended state for all hardening levels is 'Enabled'. The progression from Basic to Strict is achieved by tuning the module's parameters within the configuration itself. A Basic setup (e.g., `deny=5`, `unlock_time=900`) establishes a good baseline. A Moderate configuration enhances security by reducing the attempt threshold and increasing the lockout duration (e.g., `deny=4`, `unlock_time=1800`). A Strict configuration provides the highest level of protection by setting a very low attempt threshold and a long lockout period (e.g., `deny=3`, `unlock_time=3600`), severely impeding automated attack tools.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script to check the configuration in both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`. The script must verify that the lines `auth        required      pam_faillock.so preauth`, `auth        [default=die] pam_faillock.so authfail`, and `account     required      pam_faillock.so` are present and not commented out in the appropriate sections of both files. The script must return only the string 'Enabled' if the configuration is active, or 'Disabled' if it is not, with no extra text or formatting.

## Remediation Script Working

shell script that accepts a single positional argument: 'Enabled' or 'Disabled'. If 'Enabled', the script must use the `authconfig` command (e.g., `authconfig --enablefaillock --faillockargs="deny=5 unlock_time=900" --updateall`) to correctly configure the system PAM files. If 'Disabled', the script must use `authconfig --disablefaillock --updateall` to remove the configuration. The script must return the boolean `true` on success or `false` on failure.

