STIG: Account Lockout with pam_faillock

MediumLinux Security20-25 min

The brief

Repeated failed logins should lock an account, not invite brute force. Configure pam_faillock to the Ubuntu 22.04 STIG's lockout rule (UBTU-22-411045): lock after at most 3 failed attempts within a 15-minute window, keep the account locked until an administrator releases it (unlock_time = 0), log the lockout events (audit) and don't reveal to an attacker that an account exists or is locked (silent). Then wire pam_faillock into Ubuntu's auth stack, /etc/pam.d/common-auth, without breaking it: a correct password must still get in. Settings live in /etc/security/faillock.conf. Grading reads the files the way the STIG check does.

What you'll do

faillock deny is 1 to 3
faillock fail_interval >= 900 (failures counted over at least 15 minutes)
faillock unlock_time = 0 (locked until an administrator runs faillock --reset)
faillock.conf enables audit and silent
pam_faillock is wired into common-auth (preauth, pam_unix, authfail) and a good password still reaches pam_permit

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.