Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-5-3-2-2Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | cis-ubuntu2004-v300-5-3-2-2 |
| description | Ensure pam_faillock module is enabled |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"] |
| cis_id | 5.3.2.2 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the deny parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory.
Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Run the following commands to verify that pam_faillock is enabled:
# grep -P -- '\bpam_faillock\.so\b' /etc/pam.d/common-{auth,account}
Output should be similar to:
/etc/pam.d/common-auth:auth requisite pam_faillock.so preauth
/etc/pam.d/common-auth:auth [default=die] pam_faillock.so authfail
/etc/pam.d/common-account:account required pam_faillock.so
Create two pam-auth-update profiles in /usr/share/pam-configs/:
faillock profile in /usr/share/pam-configs/ with the following lines:Name: Enable pam_faillock to deny access
Default: yes
Priority: 0
Auth-Type: Primary
Auth:
[default=die] pam_faillock.so authfail
Example Script:
#!/usr/bin/env bash
{
arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail')
printf '%s\n' "${arr[@]}" > /usr/share/pam-configs/faillock
}
faillock_notify profile in /usr/share/pam-configs/ with the following lines:Name: Notify of failed login attempts and reset count upon success
Default: yes
Priority: 1024
Auth-Type: Primary
Auth:
requisite pam_faillock.so preauth
Account-Type: Primary
Account:
required pam_faillock.so
Example Script:
#!/usr/bin/env bash
{
arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so')
printf '%s\n' "${arr[@]}" > /usr/share/pam-configs/faillock_notify
}
Run the following command to update the common-auth and common-account PAM files with the new profiles:
# pam-auth-update --enable <profile_filename>
Example:
# pam-auth-update --enable faillock
# pam-auth-update --enable faillock_notify
Note:
pam-auth-update --enable commandName: line should be easily recognizable and understoodPriority: Line is important as it effects the order of the lines in the /etc/pam.d/ filespam_faillock module, enable that module insteadNone listed.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.2 Establish an Access Revoking Process | * | * | * |
| v7 | 16.7 Establish Process for Revoking Access | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1110, T1110.001, T1110.003 | TA0006 | M1027 |