Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The macOS system must enforce the limit of three consecutive invalid logon attempts by a user.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-209536 | AOSX-14-000020 | SV-209536r610285_rule | Medium |
| Description |
|---|
| By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. |
| STIG | Date |
|---|---|
| Apple OS X 10.14 (Mojave) Security Technical Implementation Guide | 2021-06-21 |
Details
| Check Text ( C-9787r282090_chk ) |
|---|
| The password policy is set with a configuration profile. Run the following command to check if the system has the correct setting for the number of permitted failed logon attempts: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxFailedAttempts If the return is null, or not, “maxFailedAttempts = 3”, this is a finding. |
| Fix Text (F-9787r282091_fix) |
|---|
| This setting is enforced using the “Passcode Policy" configuration profile. |