# Ensure password failed attempts lockout is configured

Necessity: Configuring an account lockout threshold after a set number of failed login attempts is a critical security control to mitigate brute-force attacks. Automated tools can try thousands of passwords per second, and without a lockout policy, they can eventually guess a weak password. This setting effectively throttles such attacks, making them computationally infeasible and alerting administrators to suspicious activity.

Auditing and Remediation: The audit script checks the PAM (Pluggable Authentication Modules) stack configuration, specifically for the `pam_faillock.so` module, to determine the current `deny` value, which dictates the number of failed attempts allowed. The remediation script modifies these same PAM configuration files (e.g., `/etc/pam.d/common-auth`) to insert or update the `pam_faillock.so` rules, setting the `deny` parameter to the desired value to enforce the lockout policy.

Recommended State Rationale:
- Basic: A value of `5` is a widely accepted baseline (e.g., in CIS Benchmarks) that balances security with usability. It effectively stops casual or unsophisticated brute-force attacks while minimizing the risk of locking out legitimate users due to typos.
- Moderate: Lowering the threshold to `4` increases security by giving an attacker fewer opportunities. This provides a better defensive posture without being overly restrictive for most user environments.
- Strict: A value of `3` offers the strongest protection against brute-force attacks by severely limiting the number of guesses an attacker can make. This state is recommended for high-security systems or environments where user accounts are high-value targets, though it carries a higher risk of accidental lockouts for legitimate users.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 0]` |
| **Moderate** | `[4, 0]` |
| **Strict** | `[3, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that inspects the relevant PAM configuration files, typically `/etc/pam.d/common-auth`, to find the `deny` value set for the `pam_faillock.so` module. The script should parse the configuration and return only the integer value of the `deny` parameter. If the parameter is not set, it should return `0`.

## Remediation Script Working

bash script that configures the `pam_faillock.so` module in the `/etc/pam.d/common-auth` and `/etc/pam.d/common-account` files. The script must accept a single positional command-line argument specifying the integer value for the `deny` parameter (the number of failed attempts before lockout). It should intelligently add or modify the `pam_faillock.so` entries to enforce this limit. The script must return `true` on successful application of the setting, and `false` on failure.

