The macOS system must enforce the limit of three consecutive invalid logon attempts by a user. (Cat II impact)
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
The password policy is set with a configuration profile. Run the following command to check if the system has the correct setting for the number of permitted failed logon attempts: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxFailedAttempts If the return is null, or not, “maxFailedAttempts = 3”, this is a finding.
This setting is enforced using the “Passcode Policy" configuration profile.
Rule ID: SV-209536r610285_rule
Vulnerability ID: V-209536
Group Title: SRG-OS-000021-GPOS-00005
The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
Unsuccessful Logon Attempts