Fidelis Network Common Criteria Configuration Guide Version 9.0.3
5
www.fidelissecurity.com
3. Add the following lines to
/etc/profile.d/autologout.sh
. The value given to the TMOUT
variable is in seconds, hence the example below sets an inactivity timeout of 15 minutes:
readonly TMOUT=900
export TMOUT
The inactivity timeout will be applied to all new login sessions. The TMOUT value in seconds should be
greater than 1 and less than 86400 (24 hours). Recommended default value is 900 (15 minutes). Setting
TMOUT to 0 or removing it from the configuration above will disable session inactivity timeout.
Configure Password Requirements for Local Users
Failed Login Attempts:
Specify the maximum number of failed login attempts allowed. The “Failed Login
Attempts” parameter defines the number of unsuccessful login attempts the user is allowed before the
user account is locked out and is configurable between 1 and 999. Recommended value is 5. To
reactivate the locked-out account, an administrator must reset that account’s password. The default
“admin” user cannot be deleted. If any other user remote access is blocked the default admin can login to
unlock these accounts.
The minimum password length is administrator configurable from 1 to 999 characters. Recommended
value is 8.
Fidelis Network components utilize Linux Pluggable Authentication Module (PAM), which provides
dynamic authentication support for component applications and services. To configure minimum
password length for logging into the component via the console, the pam-cracklib module
“minlen”
parameter must be set to the desired value in
/etc/pam.d/system-auth
PAM System
Authentication Configuration file, as shown below.
[root@linux90s ~]# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass minlen=12 retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session required pam_unix.so
[root@linux90s ~]#
Figure 1. PAM System Authentication Configuration
