---
title: "HOST-PAM-002 Account Lockout Releases Too Quickly"
canonical: https://openvapt.com/checks/HOST-PAM-002.html
html: https://openvapt.com/checks/HOST-PAM-002.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PAM-002 Account Lockout Releases Too Quickly

Checks that a locked account stays locked for at least 15 minutes (or until an administrator unlocks it).

- Domain: Server
- Severity: Low
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-307
- OWASP Top 10 2021: A07:2021
- NIST SP 800-53 Rev. 5: AC-7
- Benchmark topic: Lockout duration for failed password attempts (CIS Controls v8 5.2) (topic only, no benchmark text)

## Why It Matters

This check and HOST-PWD-004 split one control so a single root cause is never counted twice: HOST-PWD-004 covers whether lockout exists and its deny threshold (how many failures lock the account); this check covers only unlock_time (how long the lock lasts). How long the lock lasts decides whether it slows an attacker: pam_faillock's default unlock_time of 600 seconds lets guessing resume every ten minutes. Fifteen minutes or more, or 0 (manual unlock), makes online guessing impractical.

## How It Detects

Reads unlock_time from the pam_faillock lines of /etc/pam.d/common-auth, /etc/pam.d/system-auth and /etc/pam.d/password-auth, then from /etc/security/faillock.conf, else uses the module default of 600. A value of 0 or at least 900 passes. No pam_faillock at all is skipped, because HOST-PWD-004 already reports the missing lockout. Skipped when no authentication stack exists; Incomplete when one exists but cannot be read.

## How to Fix

In /etc/security/faillock.conf set  unlock_time = 900  (or 0 to require an administrator to run faillock --reset), keeping deny between 3 and 10. Keep a root session open and test in a second session before closing the first: a wrong PAM line can lock every user out, and unlock_time = 0 means locked accounts, administrators included, wait for faillock --reset.

## How to Verify

```
grep -E 'unlock_time' /etc/security/faillock.conf /etc/pam.d/common-auth /etc/pam.d/system-auth 2>/dev/null
```

## Learn the Theory

- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [pam_faillock(8), Linux-PAM](https://man7.org/linux/man-pages/man8/pam_faillock.8.html)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go

Run it: `openvapt scan --only HOST-PAM-002`. Read it offline: `openvapt explain HOST-PAM-002`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PAM-002.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.