Check: AOSX-14-000020
Apple OS X 10.14 (Mojave) STIG:
AOSX-14-000020
(in versions v2 r6 through v1 r1)
Title
The macOS system must enforce the limit of three consecutive invalid logon attempts by a user. (Cat II impact)
Discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
Check Content
The password policy is set with a configuration profile. Run the following command to check if the system has the correct setting for the number of permitted failed logon attempts: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxFailedAttempts If the return is null, or not, “maxFailedAttempts = 3”, this is a finding.
Fix Text
This setting is enforced using the “Passcode Policy" configuration profile.
Additional Identifiers
Rule ID: SV-209536r610285_rule
Vulnerability ID: V-209536
Group Title: SRG-OS-000021-GPOS-00005
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000044 |
The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period. |
Controls
Number | Title |
---|---|
AC-7 |
Unsuccessful Logon Attempts |