Remove display_login_attempts from Ubuntu 24.04's default profile - #15030
Conversation
pam_lastlog does not exist in Ubuntu 24.04, nor can pam_lastlog2 be used. Closes ComplianceAsCode#14666
|
Hi @arian-zetier. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This will remove the rule from the data stream and can break things like tailoring. @ComplianceAsCode/ubuntu-maintainers is that acceptable? |
mpurg
left a comment
mpurg
left a comment
There was a problem hiding this comment.
Hi @arian-zetier , thanks for the contribution!
I believe the issue in #14666 was already resolved in #14854 for the Ubuntu 24.04 STIG profile. However, considering that the rule is not compatible with Ubuntu 24.04 as it is written, and since it is not used in any profile, I think it's a good idea to remove it from the default profile as well.
mpurg
added
Ubuntu
3 participants
Description:
Ubuntu 24.04 does not ship with
pam_lastlogin its modules, andpam_lastlog2(its successor) is not available. #14666 was reported by another user with much better details and references the relevant changes, though the big issue is that applyingdisplay_login_attempts's remediation to a 24.04 machine locks the user out from the tty console making it inaccessible in offline environments.Rationale:
UBTU-24-300024 (V-270710) was removed in V1R5 STIG, and I do not see anything related to it for CIS, hence why it was removed from the default profile, though let me know if that's not the case. This was also removed in ansible-lockdown/UBUNTU24-STIG-Audit@97ce781
This would close #14666
Thanks!