Menu
Ensure password failed attempts lockout includes root account
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-5-3-3-1-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
| name | cis-ubuntu2004-v300-5-3-3-1-3 |
| description | Ensure password failed attempts lockout includes root account |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"] |
| cis_id | 5.3.3.1.3 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
even_deny_root - Root account can become locked as well as regular accounts.
root_unlock_time=n - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.
Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Use of unlock_time=0 or root_unlock_time=0 may allow an attacker to cause denial of service to legitimate users.
Run the following command to verify that even_deny_root and/or root_unlock_time is enabled:
# grep -Pi -- '^\h*(even_deny_root|root_unlock_time\h*=\h*\d+)\b' /etc/security/faillock.conf
Example output:
even_deny_root
--AND/OR--
root_unlock_time = 60
Run the following command to verify that - IF - root_unlock_time is set, it is set to 60 (One minute) or more:
# grep -Pi -- '^\h*root_unlock_time\h*=\h*([1-9]|[1-5][0-9])\b' /etc/security/faillock.conf
Nothing should be returned.
Run the following command to check the pam_faillock.so module for the root_unlock_time argument. Verify -IF- root_unlock_time is set, it is set to 60 (One minute) or more:
# grep -Pi -- '^\h*auth\h+([^#\n\r]+\h+)pam_faillock\.so\h+([^#\n\r]+\h+)?root_unlock_time\h*=\h*([1-9]|[1-5][0-9])\b' /etc/pam.d/common-auth
Nothing should be returned.
Edit /etc/security/faillock.conf:
root_unlock_time, - OR - set it to a value of 60 or moreeven_deny_root
Run the following command:
# grep -Pl -- '\bpam_faillock\.so\h+([^#\n\r]+\h+)?(even_deny_root|root_unlock_time)' /usr/share/pam-configs/*
Edit any returned files and remove the even_deny_root and root_unlock_time arguments from the pam_faillock.so line(s).
disabled
If a user has been locked out because they have reached the maximum consecutive failure count defined by deny= in the pam_faillock.so module, the user can be unlocked by issuing the command faillock --user <USERNAME> --reset. This command sets the failed count to 0, effectively unlocking the user.
None listed.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.2 Establish an Access Revoking Process | * | * | * |
| v7 | 16.7 Establish Process for Revoking Access | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1110, T1110.001, T1110.003 | TA0006 | M1027 |