diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml index e714c354509..a535d2645ea 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2/rule.yml @@ -71,4 +71,8 @@ ocil: |- If the account option is missing, or commented out, this is a finding. +{{% if product == "sle15" %}} +platform: os_linux[sles]<15.7 and package[pam] +{{% else %}} platform: package[pam] +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml index ef02bdaffad..12ef9749117 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_deny_root/rule.yml @@ -53,7 +53,11 @@ fixtext: |-
account required pam_tally2.so
+{{% if product == "sle15" %}} +platform: os_linux[sles]<15.7 and package[pam] +{{% else %}} platform: package[pam] +{{% endif %}} srg_requirement: |- {{{ full_name }}} must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period. diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml index d87509e59c3..d659452f47f 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_unlock_time/rule.yml @@ -46,7 +46,11 @@ fixtext: |- Modify the content of both /etc/pam.d/login, like this:
auth required pam_tally2.so deny={{{ xccdf_value("var_accounts_passwords_pam_tally2_deny") }}} unlock_time={{{ xccdf_value("var_accounts_passwords_pam_tally2_unlock_time") }}} 
+{{% if product == "sle15" %}} +platform: os_linux[sles]<15.7 and package[pam] +{{% else %}} platform: package[pam] +{{% endif %}} srg_requirement: |- {{{ full_name }}} must automatically lock an account until the locked account is released by an administrator. diff --git a/shared/applicability/os_linux.yml b/shared/applicability/os_linux.yml index dbbd8234ead..bd923dcd2b6 100644 --- a/shared/applicability/os_linux.yml +++ b/shared/applicability/os_linux.yml @@ -16,3 +16,7 @@ args: os_name: "Oracle Linux" os_id: 'ol' os_id_ansible: "OracleLinux" + sles: + os_name: "SUSE Linux Enterprise Server" + os_id: 'sles' + os_id_ansible: "SLES"