ComplianceAsCode / ComplianceAsCode/content

RHEL-8-V2R4: DISA STIG requires "silent" parameter but OpenSCAP profile audit logic causes false failure

Open
#14,522 1 comment 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

DISA STIG specifies that the system must prevent informative messages during authentication failures by ensuring the "silent" parameter is configured for pam_faillock.
However, the OpenSCAP profile audit logic results in a failure even when the silent parameter is properly configured.

#### Details:
DISA STIG requirement:

The silent parameter must be configured to suppress informative authentication failure messages.

Evaluated system configuration:

silent present in:

/etc/pam.d/system-auth

/etc/pam.d/password-auth

/etc/security/faillock.conf contains:

silent

OpenSCAP audit behavior:

The rule reports a failure despite the silent parameter being correctly configured.

The audit logic appears to enforce additional or conflicting checks across multiple files, leading to a false negative result.

The misalignment affects this profile:

- RHEL-08 V2R1-V2R4 STIG

The misalignment affects this rule:

- RHEL-08-020019

#### Outcome:

The OpenSCAP tests are corrected to look for the correct audit rule

#### SCAP Security Guide Version: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.79

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.