# Ensure password unlock time is configured

The 'unlock_time' parameter within the pam_faillock module specifies the duration in seconds for which an account will remain locked after exceeding the maximum number of failed authentication attempts. This setting is a critical defense against online brute-force password guessing attacks. A correctly configured unlock time significantly slows down attackers, rendering automated attacks impractical and giving system administrators time to detect and respond to the malicious activity. A misconfiguration, such as a very short or non-existent lockout period, effectively nullifies the protection offered by account lockout policies. The audit script verifies this setting by parsing the '/etc/security/faillock.conf' file to retrieve the current unlock time. The remediation script modifies this same file to enforce the desired lockout duration. The recommended states are tiered to provide increasing levels of protection: 'Basic' at 900 seconds (15 minutes) aligns with common security benchmarks like CIS, offering a solid baseline defense. 'Moderate' increases the delay to 1800 seconds (30 minutes), further discouraging attackers. 'Strict' sets the lockout to at least 3600 seconds (1 hour), creating a formidable barrier against brute-force attempts and providing a wide window for incident response.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900, 3600]` |
| **Moderate** | `[1800, 3600]` |
| **Strict** | `[3600, 3600]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the PAM configuration to find the `unlock_time` value for the `pam_faillock` module. The script should primarily search for this setting in `/etc/security/faillock.conf`. It must extract and return only the numeric value of `unlock_time` in seconds. If the setting is not explicitly configured, it should return the default value, which is '900'.

## Remediation Script Working

Bash script that takes a single positional integer argument representing the desired unlock time in seconds. The script must configure the `pam_faillock` module by setting the `unlock_time` value in `/etc/security/faillock.conf`. If the `unlock_time` setting already exists, it should be updated; if not, it should be added to the file. The script must return `true` if the configuration is successfully applied and `false` otherwise.

