diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml index faa85597accf..24cf2dec6172 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml @@ -9,7 +9,11 @@ description: |- Ensure that the file /etc/security/faillock.conf contains the following entry: unlock_time=<interval-in-seconds> where +{{% if product == 'ubuntu2404' %}} + interval-in-seconds is {{{xccdf_value("var_accounts_passwords_pam_faillock_unlock_time") }}}. +{{% else %}} interval-in-seconds is {{{xccdf_value("var_accounts_passwords_pam_faillock_unlock_time") }}} or greater. +{{% endif %}} pam_faillock.so module requires multiple entries in pam files. These entries must be carefully defined to work as expected. In order to avoid any errors when manually editing these files, @@ -108,3 +112,6 @@ template: ext_variable: var_accounts_passwords_pam_faillock_unlock_time description: The unlock time after number of failed logins should be set correctly. variable_lower_bound: use_ext_variable +{{% if product == 'ubuntu2404' %}} + variable_upper_bound: use_ext_variable +{{% endif %}}