diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml index e714c354509..a535d2645ea 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml @@ -71,4 +71,8 @@ ocil: |- If the account option is missing, or commented out, this is a finding. +{{% if product == "sle15" %}} +platform: os_linux[sles]<15.7 and package[pam] +{{% else %}} platform: package[pam] +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml index ef02bdaffad..12ef9749117 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml @@ -53,7 +53,11 @@ fixtext: |-
account required pam_tally2.so+{{% if product == "sle15" %}} +platform: os_linux[sles]<15.7 and package[pam] +{{% else %}} platform: package[pam] +{{% endif %}} srg_requirement: |- {{{ full_name }}} must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml index d87509e59c3..d659452f47f 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml @@ -46,7 +46,11 @@ fixtext: |- Modify the content of both /etc/pam.d/login, like this:
auth required pam_tally2.so deny={{{ xccdf_value("var_accounts_passwords_pam_tally2_deny") }}} unlock_time={{{ xccdf_value("var_accounts_passwords_pam_tally2_unlock_time") }}}
+{{% if product == "sle15" %}}
+platform: os_linux[sles]<15.7 and package[pam]
+{{% else %}}
platform: package[pam]
+{{% endif %}}
srg_requirement: |-
{{{ full_name }}} must automatically lock an account until the locked account is released by an administrator.
diff --git a/shared/applicability/os_linux.yml b/shared/applicability/os_linux.yml
index dbbd8234ead..bd923dcd2b6 100644
--- a/shared/applicability/os_linux.yml
+++ b/shared/applicability/os_linux.yml
@@ -16,3 +16,7 @@ args:
os_name: "Oracle Linux"
os_id: 'ol'
os_id_ansible: "OracleLinux"
+ sles:
+ os_name: "SUSE Linux Enterprise Server"
+ os_id: 'sles'
+ os_id_ansible: "SLES"