Account lockout duration must be properly configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25240	OSX00045 M6	SV-37184r1_rule	ECLO-1 ECLO-2	Medium

Description
This parameter specifies the amount of time that must pass between two successive login attempts to ensure a lockout will occur. The smaller this value is, the less effective the account lockout feature will be in protecting the local system.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft	2013-01-10

Details

Check Text ( C-35886r1_chk )
Open a terminal session and use the following command to view the setting for Account lockout duration. sudo pwpolicy -n -getglobalpolicy \| tr " " "\n" \| grep minutesUntilFailedLoginReset If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy \| tr " " "\n" \| grep minutesUntilFailedLoginReset If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding.

Check Text ( C-35886r1_chk )

Open a terminal session and use the following command to view the setting for Account lockout duration.
sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset
If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding.

NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems.
pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset
If the value of "minutesUntilFailedLoginReset" is greater than "0", this is a finding.

Fix Text (F-31142r1_fix)
Open a terminal session and use the following command to set the value for account lockout duration. sudo pwpolicy -n -setglobalpolicy "minutesUntilFailedLoginReset=0" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "minutesUntilFailedLoginReset=0"