Modify apply method for 9.2.11

bin/hardening/9.2.11_enable_lockout_failed_password.sh

@@ -5,8 +5,9 @@
 #
 
 #
-# 9.2.11 Set Lockout for Failed Password Attempts (Not Scored)
+# 9.2.11 Set Lockout for Failed Password Attempts (Scored)
 # The number in the original document is 9.2.2
+# for login and ssh service
 #
 
 set -e # One error, it's over
@@ -15,8 +16,8 @@ set -u # One variable unset, it's over
 HARDENING_LEVEL=3
 
 PACKAGE='libpam-modules-bin'
-PATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so'
-FILE='/etc/pam.d/login'
+AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so'
+AUTHFILE='/etc/pam.d/common-auth'
 
 # This function will be called if the script status is on enabled / audit mode
 audit () {
@@ -26,12 +27,12 @@ audit () {
         FNRET=1
     else
         ok "$PACKAGE is installed"
-        does_pattern_exist_in_file $FILE $PATTERN
+        does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN
         if [ $FNRET = 0 ]; then
-            ok "$PATTERN is present in $FILE"
+                ok "$AUTHPATTERN is present in $AUTHFILE."
                 FNRET=0
         else
-            crit "$PATTERN is not present in $FILE"
+            crit "$AUTHPATTERN is not present in $AUTHFILE"
             FNRET=2
         fi
     fi
@@ -42,11 +43,11 @@ apply () {
     if [ $FNRET = 0 ]; then
         ok "installed"
     elif [ $FNRET = 1 ]; then
-        crit "Apply:$PACKAGE is absent, installing it"
+        warn "Apply:$PACKAGE is absent, installing it"
         apt_install $PACKAGE
     elif [ $FNRET = 2 ]; then
-        crit "Apply:$PATTERN is not present in $FILE"
-        add_line_file_before_pattern $FILE "auth required pam_tally2.so onerr=fail deny=6 unlock_time=1800" "# Uncomment and edit /etc/security/time.conf if you need to set"
+        warn "Apply:$AUTHPATTERN is not present in $AUTHFILE"
+        add_line_file_after_pattern $AUTHFILE "auth required pam_tally2.so audit deny=3 unlock_time=900" "# pam-auth-update(8) for details."
     fi
 }
 

lib/utils.sh

@@ -136,6 +136,19 @@ add_line_file_before_pattern() {
     FNRET=0
 }
 
+add_line_file_after_pattern() {
+    local FILE=$1
+    local LINE=$2
+    local PATTERN=$3
+
+    backup_file "$FILE"
+    debug "Inserting $LINE before $PATTERN in $FILE"
+    PATTERN=$(sed 's@/@\\\/@g' <<< $PATTERN)
+    debug "sed -i '/$PATTERN/a $LINE' $FILE"
+    sed -i "/$PATTERN/a $LINE" $FILE
+    FNRET=0
+}
+
 replace_in_file() {
     local FILE=$1
     local SOURCE=$2