Account lockout threshold must be properly configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25241	OSX00050 M6	SV-37186r1_rule	ECLO-1 ECLO-2	Medium

Description
The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of incorrect logon attempts should be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.

Description

The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of incorrect logon attempts should be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft	2013-01-10

Details

Check Text ( C-35887r1_chk )
Open a terminal session and use the following command to view the setting for account lockout threshold. sudo pwpolicy -n -getglobalpolicy \| tr " " "\n" \| grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy \| tr " " "\n" \| grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding.

Check Text ( C-35887r1_chk )

Open a terminal session and use the following command to view the setting for account lockout threshold.
sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts
If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding.

NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems.
pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts
If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding.

Fix Text (F-31143r1_fix)
Open a terminal session and use the following command to set the value for account lockout threshold. sudo pwpolicy -n -setglobalpolicy "maxFailedLoginAttempts=3" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=3"