DLPX-86530 CIS: delphix user lockout after failed login attempts

[rupalimatkar]

Background

CIS: delphix user lockout after failed login attempts

JIRA: https://delphix.atlassian.net/browse/DLPX-86530

Status of the 'deny' setting for pam_tally2.so module in /etc/pam.d/common-auth file
Located in the /etc/pam.d directory, the 'pam_tally2.so' module allows administrators to manage user login security policy and monitor user login activity. The 'deny' parameter in the 'pam_tally2.so' module sets the number of failed login attempts allowed prior to account lockout. As a malicious user can use brute force attacks to compromise user accounts, account lockout policies mitigate this risk by restricting failed login attempts. The 'deny' parameter in the 'pam_tally2.so' module should be set in accordance with needs of the organization.

Remediation: Edit the /etc/pam.d/common-auth file and add the auth line below:
auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900

Solution

Updating the pam modules common-auth and common-account to enforce delphix user lockout policies using pam_tally2.so

Testing Done

http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8569/console
http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8523/console - In-progress
http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8456/ - In-progress
http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8394/ - In-progress
http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8391/ - In-progress
http://selfservice.jenkins.delphix.com/job/appliance-build-orchestrator-pre-push/8389/console - Successful

With 4 unsuccessful login attempts and 5th successful login attempt with delphix user -

With 5 unsuccessful login attempts and entering correct password at 6th attempt with delphix user -

delphix user lockout already happened and after unlock time completion connection to engine will be successful with correct password.

Re-login to engine with delphix user after unlock period is over -