Title

Account lockout duration must be properly configured. (Cat II impact)

Discussion

This parameter specifies the amount of time that must pass between two successive login attempts to ensure a lockout will occur. The smaller this value is, the less effective the account lockout feature will be in protecting the local system.

Check Content

Open a terminal session and use the following command to view the setting for Account lockout duration. sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding.

Fix Text

Open a terminal session and use the following command to set the value for account lockout duration. sudo pwpolicy -n -setglobalpolicy "minutesUntilFailedLoginReset=0" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "minutesUntilFailedLoginReset=0"

Additional Identifiers

Rule ID: SV-37184r1_rule

Vulnerability ID: V-25240

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.