The Jamf Pro EMM must enforce the limit of three consecutive invalid logon attempts by a user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-99627	JAMF-10-100810	SV-108731r1_rule		Medium

Description
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. SFR ID: FMT_SMF.1(2)b. / IA-7-a Satisfies: SRG-APP-000065

STIG	Date
Jamf Pro v10.x EMM Security Technical Implementation Guide	2020-02-04

Details

Check Text ( C-98477r1_chk )
To verify the Jamf Pro EMM enforces a limit of three consecutive invalid logon attempts by a user, do the following: 1. Log in to the Jamf Pro EMM console. 2. Open "Settings". 3. Select "Jamf Pro User Accounts & Groups". 4. Select "Password Policy" in the upper right corner. 5. Verify that under "Account Lockout" the number of failed attempts before lockout is set to "3" or less. If the Jamf Pro EMM does not limit the number of consecutive invalid logon attempts by a user to "3" or less, this is a finding.

Check Text ( C-98477r1_chk )

To verify the Jamf Pro EMM enforces a limit of three consecutive invalid logon attempts by a user, do the following:

1. Log in to the Jamf Pro EMM console.
2. Open "Settings".
3. Select "Jamf Pro User Accounts & Groups".
4. Select "Password Policy" in the upper right corner.
5. Verify that under "Account Lockout" the number of failed attempts before lockout is set to "3" or less.

If the Jamf Pro EMM does not limit the number of consecutive invalid logon attempts by a user to "3" or less, this is a finding.

Fix Text (F-105311r1_fix)
To configure the Jamf Pro EMM server to lock after three consecutive invalid logon attempts by a user, do the following: 1. Open "Settings". 2. Select "Jamf Pro User Accounts & Groups". 3. Select “Password Policy” in the upper right corner. 4. Select "Edit". 5. Under “Account Lockout”, select the drop-down menu to change the number of failed attempts before lockout to "3". 6. Select “Save”.

Fix Text (F-105311r1_fix)

To configure the Jamf Pro EMM server to lock after three consecutive invalid logon attempts by a user, do the following:

1. Open "Settings".
2. Select "Jamf Pro User Accounts & Groups".
3. Select “Password Policy” in the upper right corner.
4. Select "Edit".
5. Under “Account Lockout”, select the drop-down menu to change the number of failed attempts before lockout to "3".
6. Select “Save”.