Yet another question regarding security scanning. What does security scanning output mean?

Result: FAILED

Actual Value: The command returned : 

auth        required                                     pam_faillock.so preauth silent
auth        required                                     pam_faillock.so authfail
account     required                                     pam_faillock.so

Policy Value: cmd: grep ""pam_faillock.so"" /etc/pam.d/password-auth | awk '{print} END {if (NR == 0) print ""Account lockout for 'password-auth' not set""}'
dont_echo_cmd: YES
expect: deny[\s]*=[\s]*5[\s]*unlock_time[\s]*=[\s]*300
system: Linux

1 Answer 1


The scan expects to see options deny = 5 unlock_time = 300 (the amount of whitespace may vary) somewhere on the pam_faillock.so lines in the /etc/pam.d/password-auth file.

It did not see them, and so this part of the scan is marked as failed.

Apparently, the scan executes the command specified in Policy Value: cmd: line, and the output of that command should match the Perl-Compatible Regular Expression (PCRE for short) on the expect: line.

The doubled double quotes ("") on the Policy Value: cmd: line may be a result of how the scanner itself is implemented. If you try running the command yourself, you might want to remove the doubling:

grep "pam_faillock.so" /etc/pam.d/password-auth | awk '{print} END {if (NR == 0) print "Account lockout for 'password-auth' not set"}'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .