From 3d9eb7256499b625f8b92b9f0b4cd0e962363d23 Mon Sep 17 00:00:00 2001
From: "rupali.matkar" <rupali.matkar@delphix.com>
Date: Thu, 26 Dec 2024 14:46:30 +0530
Subject: [PATCH] DLPX-86530 CIS: delphix user lockout after failed login
attempts
PR URL: https://www.github.com/delphix/delphix-platform/pull/504
---
.../roles/delphix-platform/tasks/main.yml | 30 +++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
index 36f1956af..4985837e9 100644
--- a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
+++ b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml
@@ -336,6 +336,36 @@
regexp: '^#?[\s]*(auth[\s]+required[\s]+pam_wheel\.so.*)$'
replace: '\1'
+#
+# Lock out the user after an unsuccessful consecutive login attempts.
+#
+- lineinfile:
+ path: /etc/pam.d/common-auth
+ line: "{{ item }}"
+ insertbefore: '^auth\s+\[success=1\s+default=ignore\]\s+pam_unix\.so\s+nullok\s+try_first_pass'
+ with_items:
+ - 'auth required pam_tally2.so audit silent deny=5 unlock_time=900'
+
+#
+# Configuration to enforce account lockout policies.
+#
+- lineinfile:
+ path: /etc/pam.d/common-account
+ line: "{{ item }}"
+ insertafter: EOF
+ with_items:
+ - 'account required pam_tally2.so'
+
+#
+# Configuration to remember user password history.
+#
+- lineinfile:
+ path: /etc/pam.d/common-password
+ line: "{{ item }}"
+ insertbefore: '^password\s+\[success=1 default=ignore\]\s+pam_unix\.so\s+obscure\s+sha512'
+ with_items:
+ - 'password required pam_pwhistory.so remember=5'
+
#
# Enable SNMP client tools to load MIBs by default.
#