Ensure the Logon Failure Delay is Set Correctly in login.defs
Ensures FAIL_DELAY in /etc/login.defs is at least 4 seconds, delaying the prompt after a failed login.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
Increasing the time between a failed authentication attempt and the next credential prompt slows single-threaded brute-force attacks against console and other login interfaces. A FAIL_DELAY of at least 4 seconds makes exhaustive password guessing impractically slow while remaining unobtrusive for legitimate users.
What Pavois checks
Pavois uses the InSpec login_defs resource to read the effective resolved value of FAIL_DELAY, parsing /etc/login.defs the way the login program interprets it (last uncommented setting wins). This reflects the delay actually enforced at login, not just a line that happens to appear in the file.
describe login_defs do
its('FAIL_DELAY') { should cmp >= 4 }
endHow to verify it is applied
grep -i '^FAIL_DELAY' /etc/login.defsshould printFAIL_DELAY 4(or higher).- At a console login, an incorrect password should hold for ~4 s before re-prompting.
Inspect & investigate
grep -i FAIL_DELAY /etc/login.defsshows the configured delay./var/log/secure(RHEL) records authentication failures fromlogin/PAM.journalctl _COMM=loginshows console login attempts.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set FAIL_DELAY 4 (or higher) in /etc/login.defs. The value takes effect for subsequent console/PAM logins handled by the login program.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | FAIL_DELAY |
| resource | conf_line |
| sep | space |
| value | 4 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible risk. The only effect is a few seconds of delay after a failed console login, which is imperceptible to legitimate users. Note it applies to the login program path; SSH and other services enforce their own retry/throttle controls, so this is one layer among several.