AWS inspector というセキュリティ診断ツールで以下のような診断結果が出たのですが対応方法がわかりません
結果 Instance xxxxxxxx is not compliant with rule 5.3.2 Ensure lockout for failed password attempts is configured, 1.0.0 CIS Amazon Linux 2 Benchmark. Applicable profiles: Level 1, Level 2.
重要度 High
説明
Description Lock out users after n unsuccessful consecutive login attempts. The first sets of changes are made to the PAM configuration files. The second set of changes are applied to the program specific PAM configuration file. The second set of changes must be applied to each program that will lock out users. Check the documentation for each secondary program for instructions on how to configure them to work with PAM. Set the lockout number to the policy in effect at your site. Rationale Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
推奨事項
Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files and add the following pam_faillock.so lines surrounding a pam_unix.so line modify the pam_unix.so is [success=1 default=bad] as listed in both: auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900auth [success=1 default=bad] pam_unix.soauth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
書かれてあるとおり /etc/pam.d/password-auth /etc/pam.d/system-auth を以下のように変更したのですが
再度診断を行うとやはり同じ診断結果が出てしまいます
(追加したのは後半のauthで始まる7行 最後の1行は別の診断で必要になった1行)
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_deny.so
account required pam_unix.so
password requisite pam_pwquality.so try_first_pass retry=3
password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
auth required pam_faillock.so pre
auth audit silent deny=5 unlock_time=900
auth [success=1 default=bad] pam_unix.so
auth [default=die] pam_faillock.so
auth failaudit deny=5 unlock_time=900
auth sufficient pam_faillock.so
auth succaudit deny=5 unlock_time=900
password sufficient pam_unix.so remember=5
追記:
推奨事項 が改行なしのコードになっているのでおそらく auth で始まる部分に改行があると思って勝手に改行したんですが、
auth succaudit みたいな書き方が検索しても出てこないので他にも書き方が間違っているんでしょうか
preauth
の部分は分割しない1つのキーワード、文のようです ex: server-memo.net/server-setting/ssh/account_lock_ssh.htmlman pam.d
等でも確認できるので参考にしてみては如何でしょうか。