Detections
Analytics
AIX7-00-001003 - AIX must enforce the limit of three consecutive invalid login attempts by a user before the user account is locked and released by an administrator.
Information
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128
Solution
From the command prompt, execute the following command to configure the number of unsuccessful logins resulting in account lockout for "default:" stanza in "/etc/security/user" file:# chsec -f /etc/security/user -s default -a loginretries=3
From the command prompt, execute the following command to configure the number of unsuccessful logins resulting in account lockout for all users who have loginretries values that are 0 or greater than 3:
# chsec -f /etc/security/user -s [user_name] -a loginretries=3
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R2_STIG.zip
Item Details
Audit Name: DISA IBM AIX 7.x STIG v3r2
Category: ACCESS CONTROL
References: 800-53|AC-7a., 800-53|AC-7b., CAT|II, CCI|CCI-000044, CCI|CCI-002238, Rule-ID|SV-215171r958388_rule, STIG-ID|AIX7-00-001003, STIG-Legacy|SV-101319, STIG-Legacy|V-91219, Vuln-ID|V-215171
Plugin: Unix
Control ID: 6bc7bc15e9f77652fad20f63a89a184561d92f563352e139efd6ca7ca3ace3a7