Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-5-3-2-2El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-ubuntu2004-v300-5-3-2-2 |
| description | Ensure pam_faillock module is enabled |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"] |
| cis_id | 5.3.2.2 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack |
| ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the deny parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory.
Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Run the following commands to verify that pam_faillock is enabled:
# grep -P -- '\bpam_faillock\.so\b' /etc/pam.d/common-{auth,account}
Output should be similar to:
/etc/pam.d/common-auth:auth requisite pam_faillock.so preauth
/etc/pam.d/common-auth:auth [default=die] pam_faillock.so authfail
/etc/pam.d/common-account:account required pam_faillock.so
Create two pam-auth-update profiles in /usr/share/pam-configs/:
faillock profile in /usr/share/pam-configs/ with the following lines:Name: Enable pam_faillock to deny access
Default: yes
Priority: 0
Auth-Type: Primary
Auth:
[default=die] pam_faillock.so authfail
Example Script:
#!/usr/bin/env bash
{
arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail')
printf '%s\n' "${arr[@]}" > /usr/share/pam-configs/faillock
}
faillock_notify profile in /usr/share/pam-configs/ with the following lines:Name: Notify of failed login attempts and reset count upon success
Default: yes
Priority: 1024
Auth-Type: Primary
Auth:
requisite pam_faillock.so preauth
Account-Type: Primary
Account:
required pam_faillock.so
Example Script:
#!/usr/bin/env bash
{
arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so')
printf '%s\n' "${arr[@]}" > /usr/share/pam-configs/faillock_notify
}
Run the following command to update the common-auth and common-account PAM files with the new profiles:
# pam-auth-update --enable <profile_filename>
Example:
# pam-auth-update --enable faillock
# pam-auth-update --enable faillock_notify
Note:
pam-auth-update --enable commandName: line should be easily recognizable and understoodPriority: Line is important as it effects the order of the lines in the /etc/pam.d/ filespam_faillock module, enable that module insteadNone listed.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.2 Establish an Access Revoking Process | * | * | * |
| v7 | 16.7 Establish Process for Revoking Access | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1110, T1110.001, T1110.003 | TA0006 | M1027 |