mediumaccess-controlverified ✓rollback-safe

Configure faillock persistent tally directory

faillock-dir-configured · RHEL ≥ 8 · 1 impl

Description

The dir option in /etc/security/faillock.conf must be set to a persistent directory path to ensure failed login attempt counts survive reboots. The default /var/run/faillock is cleared on reboot.

Rationale

Without a persistent tally directory, failed login counters are lost on reboot, allowing attackers to circumvent account lockout by rebooting the system. Using a persistent directory such as /var/log/faillock ensures lockout state is maintained across reboots.

Check → Remediate

Checkconfig_value

path:: /etc/security/faillock.conf
key:: dir
expected:: /var/log/faillock

Remediateconfig_set

path:: /etc/security/faillock.conf
key:: dir
value:: /var/log/faillock
separator:: =

Framework references

STIG

V-281198 / RHEL-10-600430V-258060 / RHEL-09-411105V-230339

NIST 800-53

AC-7

Live verification

rhel8:checkrhel9:check

#pam#authentication#faillock#persistence