ONTAP must be configured to enforce the limit of three consecutive failed logon attempts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246931	NAOT-AC-000010	SV-246931r835216_rule		Medium

Description
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

STIG	Date
NetApp ONTAP DSC 9.x Security Technical Implementation Guide	2022-06-07

Details

Check Text ( C-50363r835214_chk )
Use the command "security login role config show" to get a list of roles. For each role, use the command "security login role config show -vserver -role " to view the password requirements for each role. If any role has "Maximum Number of Failed Attempts" not set to 3, this is a finding. Use "security login role config show -role admin -instance" to see the settings for "Maximum Number of Failed Attempts" and “Delay after Each Failed Login Attempt". If ONTAP is not configured to enforce a limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes, this is a finding.

Check Text ( C-50363r835214_chk )

Use the command "security login role config show" to get a list of roles.

For each role, use the command "security login role config show -vserver -role " to view the password requirements for each role.

If any role has "Maximum Number of Failed Attempts" not set to 3, this is a finding.

Use "security login role config show -role admin -instance" to see the settings for "Maximum Number of Failed Attempts" and “Delay after Each Failed Login Attempt".

If ONTAP is not configured to enforce a limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes, this is a finding.

Fix Text (F-50317r835215_fix)
Use the command "security login role config show" to get a list of roles. For each role, use the command "security login role config show -vserver -role " to view the password requirements for each role. For any role that does not have "Maximum Number of Failed Attempts" set to 3, use the command "security login role config modify -role -vserver -max-failed-login-attempts 3".