Title

Account lockout threshold must be properly configured. (Cat II impact)

Discussion

The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of incorrect logon attempts should be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.

Check Content

Open a terminal session and use the following command to view the setting for account lockout threshold. sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding.

Fix Text

Open a terminal session and use the following command to set the value for account lockout threshold. sudo pwpolicy -n -setglobalpolicy "maxFailedLoginAttempts=3" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=3"

Additional Identifiers

Rule ID: SV-37186r1_rule

Vulnerability ID: V-25241

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.