ComplianceAsCode / ComplianceAsCode/content
RHEL-8-V2R4: DISA STIG requires "silent" parameter but OpenSCAP profile audit logic causes false failure
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
DISA STIG specifies that the system must prevent informative messages during authentication failures by ensuring the "silent" parameter is configured for pam_faillock.
However, the OpenSCAP profile audit logic results in a failure even when the silent parameter is properly configured.
#### Details:
DISA STIG requirement:
The silent parameter must be configured to suppress informative authentication failure messages.
Evaluated system configuration:
silent present in:
/etc/pam.d/system-auth
/etc/pam.d/password-auth
/etc/security/faillock.conf contains:
silent
OpenSCAP audit behavior:
The rule reports a failure despite the silent parameter being correctly configured.
The audit logic appears to enforce additional or conflicting checks across multiple files, leading to a false negative result.
The misalignment affects this profile:
- RHEL-08 V2R1-V2R4 STIG
The misalignment affects this rule:
- RHEL-08-020019
#### Outcome:
The OpenSCAP tests are corrected to look for the correct audit rule
#### SCAP Security Guide Version: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.79
Contributor guide
Assessment
This issue has not been assessed yet.