Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Database accounts should not specify account lock times less than the site-approved minimum.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-3817 | DG0073-ORACLE10 | SV-24649r1_rule | ECLO-1 ECLO-2 | Medium |
| Description |
|---|
| The FAILED_LOGIN_ATTEMPTS value limits the number of failed login attempts allowed before an account is locked. Setting this value limits the ability of unauthorized users to guess passwords and alerts the DBA when password guessing has occurred (accounts display as locked). For non-interactive accounts, the number of failed logins should be set to an IAO-approved value. |
| STIG | Date |
|---|---|
| Oracle 10 Database Instance STIG | 2014-01-14 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-26185r1_fix) |
|---|
| Modify profiles to meet the failed login attempt requirement limit. From SQL*Plus: alter profile default limit failed_login_attempts 3; alter profile [profile name] limit failed_login_attempts [IAO-approved value]; Replace [profile name] with any existing, non-default profile names. Document in the System Security Plan all profiles and settings. |