# Ensure password unlock time is configured

The `unlock_time` parameter within the `pam_faillock` module specifies the duration in seconds for which an account remains locked after exceeding the configured number of failed login attempts. This setting is a critical defense mechanism against online brute-force password attacks. A properly configured lockout duration significantly increases the time and resources required for an attacker to guess a password, thereby protecting user accounts and system integrity. Misconfiguration can either render the lockout ineffective (if the time is too short) or cause a denial of service for legitimate users (if the time is excessively long or requires manual intervention in an environment not prepared for it). The audit script checks the configured value in `/etc/security/faillock.conf`. The remediation script modifies this file to set the `unlock_time` to a desired value, strengthening the system's resilience against brute-force attacks. The Basic state of 900 seconds (15 minutes) provides a solid baseline deterrent, aligning with CIS Level 1 recommendations. The Moderate state of 1800 seconds (30 minutes) offers enhanced protection by further slowing down potential attackers. The Strict state of 0 configures the account to remain locked until an administrator manually intervenes. This is the most secure setting as it forces a security review of any lockout event, effectively neutralizing automated attacks, and is recommended for high-security systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900, 3600]` |
| **Moderate** | `[1800, 3600]` |
| **Strict** | `[3600, 3600]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `/etc/security/faillock.conf` file for the `unlock_time` setting. The script must parse the file to find the numerical value assigned to `unlock_time` and output only this integer value to standard output. If the value is not explicitly set, the script should output the system default of 600.

## Remediation Script Working

Bash script that accepts a single positional integer argument representing the desired password unlock time in seconds. The script must modify the `/etc/security/faillock.conf` file by setting the `unlock_time` parameter to the provided value. If the parameter is commented out or absent, the script must add or uncomment it accordingly. The script must output `true` on successful modification and `false` on failure.

