The CA VM:Secure JOURNAL Facility parameters must be set for lockout after 3 attempts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-237901	IBMZ-VM-000045	SV-237901r649543_rule		Medium

Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

STIG	Date
IBM zVM Using CA VM:Secure Security Technical Implementation Guide	2021-06-16

Details

Check Text ( C-41111r649541_chk )
Examine VM:Secure Security Config File. If there is no Journal record this is a finding. If the Journal record has a maximum consecutive invalid password attempts set to 3, this is not a finding. Note: The "warning" setting may be determined by the site but must be 3 or less. Example: JOURNAL 3 3

Fix Text (F-41070r649542_fix)
Edit the SECURITY CONFIG file: vmsecure config security Configure a JOURNAL record in the SECURITY CONFIG file as follows: JOURNAL 3 3 Note: The "warning" setting may be determined by the site but must be 3 or less.