64087


AWS inspector というセキュリティ診断ツールで以下のような診断結果が出たのですが対応方法がわかりません

[code]

    結果 Instance xxxxxxxx is not compliant with rule 5.3.2 Ensure lockout for failed password attempts is configured, 1.0.0 CIS Amazon Linux 2 Benchmark. Applicable profiles: Level 1, Level 2.
    重要度 High 
    説明 
    Description Lock out users after n unsuccessful consecutive login attempts. The first sets of changes are made to the PAM configuration files. The second set of changes are applied to the program specific PAM configuration file. The second set of changes must be applied to each program that will lock out users. Check the documentation for each secondary program for instructions on how to configure them to work with PAM. Set the lockout number to the policy in effect at your site. Rationale Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
    
    推奨事項 
    Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files and add the following pam_faillock.so lines surrounding a pam_unix.so line modify the pam_unix.so is [success=1 default=bad] as listed in both: auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900auth [success=1 default=bad] pam_unix.soauth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
    
[/code]

書かれてあるとおり /etc/pam.d/password-auth /etc/pam.d/system-auth を以下のように変更したのですが  
再度診断を行うとやはり同じ診断結果が出てしまいます  
(追加したのは後半のauthで始まる７行 最後の１行は別の診断で必要になった１行）

[code]

    #%PAM-1.0
    # This file is auto-generated.
    # User changes will be destroyed the next time authconfig is run.
    auth        required      pam_env.so
    auth        sufficient    pam_unix.so try_first_pass nullok
    auth        required      pam_deny.so
    
    account     required      pam_unix.so
    
    password    requisite     pam_pwquality.so try_first_pass retry=3
    password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow
    password    required      pam_deny.so
    
    session     optional      pam_keyinit.so revoke
    session     required      pam_limits.so
    -session     optional      pam_systemd.so
    session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
    session     required      pam_unix.so
    
    auth required pam_faillock.so pre
    auth audit silent deny=5 unlock_time=900
    auth [success=1 default=bad] pam_unix.so
    auth [default=die] pam_faillock.so
    auth failaudit deny=5 unlock_time=900
    auth sufficient pam_faillock.so
    auth succaudit deny=5 unlock_time=900
    
    password sufficient pam_unix.so remember=5
    
[/code]

* * *

追記：  
推奨事項 が改行なしのコードになっているのでおそらく auth で始まる部分に改行があると思って勝手に改行したんですが、  
auth succaudit みたいな書き方が検索しても出てこないので他にも書き方が間違っているんでしょうか


CC BY-SA 4.0
2020-03-23T08:09:06.867
64041
2020-03-24T14:54:09.790
2020-03-24T02:09:52.933
question
linux aws
AWS inspector rule 5.3.2 の対応方法


PAM の書式に従って改行すると、以下のようになると思います。

[code]

    auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
    auth [success=1 default=bad] pam_unix.so
    auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
    auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
    
[/code]

`auth` の順番に意味を持ちますので、ファイルの後ろに追記してはダメです。  
**auth ... pam_unix.so** 行を置き換えよ、とのことですので、  
auth 行は以下のようにするのではないでしょうか？

[code]

    auth    required                pam_env.so
    auth    required                pam_faillock.so preauth audit silent deny=5 unlock_time=900
    auth    [success=1 default=bad] pam_unix.so
    auth    [default=die]           pam_faillock.so authfail audit deny=5 unlock_time=900
    auth    sufficient              pam_faillock.so authsucc audit deny=5 unlock_time=900
    auth    required                pam_deny.so
    
[/code]


CC BY-SA 4.0
2020-03-24T14:54:09.790
64087
2020-03-24T14:54:09.790
4603
64041
answer