From 6d1146e75ebffc03cc78a97a3a184b4b751882c3 Mon Sep 17 00:00:00 2001 From: Christopher Berger Date: Tue, 9 Jun 2026 02:53:00 +0000 Subject: [PATCH] fixed pam.d/common-auth script locks user out. added the following to AC-7 sed -i 's/\[success=1 default=ignore\]\s*pam_unix.so/[success=2 default=ignore] pam_unix.so/' \ /etc/pam.d/common-auth --- scripts/nist-800-53-harden-v2.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/nist-800-53-harden-v2.sh b/scripts/nist-800-53-harden-v2.sh index 462ccd0..8763fb6 100644 --- a/scripts/nist-800-53-harden-v2.sh +++ b/scripts/nist-800-53-harden-v2.sh @@ -154,6 +154,8 @@ sed -i '/^auth.*pam_unix.so/i auth required pam_faillo /etc/pam.d/common-auth sed -i '/^auth.*pam_unix.so/a auth [default=die] pam_faillock.so authfail' \ /etc/pam.d/common-auth +sed -i 's/\[success=1 default=ignore\]\s*pam_unix.so/[success=2 default=ignore] pam_unix.so/' \ + /etc/pam.d/common-auth echo "account required pam_faillock.so" >> /etc/pam.d/common-account