mediumaccess-controlverified ✓

Enforce a PAM-based delay after a failed logon attempt

pam-faildelay-common-auth · UBUNTU ≥ 22 · 1 impl

Description

On systems that enforce the failed-logon delay through the PAM stack, the pam_faildelay.so module must be enabled in /etc/pam.d/common-auth with a delay of at least 4000000 microseconds (4 seconds).

Rationale

Inserting a delay after a failed logon attempt limits the rate of brute-force attacks. Debian-family systems configure this delay in the PAM authentication stack (common-auth) in microseconds rather than through login.defs, so the delay must be asserted where the platform actually enforces it.

Check → Remediate

Checkcommand

line=$(grep -E '^[[:space:]]*auth[[:space:]].*pam_faildelay\.so' /etc/pam.d/common-auth 2>/dev/null)
[ -n "$line" ] || { echo "FAIL: pam_faildelay not enabled in common-auth"; exit 1; }
delay=$(printf '%s\n' "$line" | grep -oE 'delay=[0-9]+' | grep -oE '[0-9]+' | head -1)
[ -n "$delay" ] && [ "$delay" -ge 4000000 ] 2>/dev/null || {
  echo "FAIL: pam_faildelay delay is below 4000000 microseconds"; exit 1; }
echo "OK: pam_faildelay delay=$delay"; exit 0

expected_exit:: 0

Remediatemanual

note:: Add or correct the pam_faildelay line in /etc/pam.d/common-auth so the delay is at least 4000000 microseconds (4 seconds), e.g. 'auth required pam_faildelay.so delay=4000000'.

Framework references

STIG

V-270706 / UBTU-24-300017V-260550 / UBTU-22-412010

NIST 800-53

AC-7

Live verification

ubuntu22:checkubuntu24:check

#pam#authentication#faildelay#brute-force#stig