Detections
Analytics

SOL-11.1-040140 - The system must disable accounts after three consecutive unsuccessful login attempts.

Information

Allowing continued access to accounts on the system exposes them to brute-force password-guessing attacks.

Solution

The root role is required.

# pfedit /etc/default/login

Change the line:

#RETRIES=5

to read

RETRIES=3

pfedit /etc/security/policy.conf

Change the line containing

#LOCK_AFTER_RETRIES

to read:

LOCK_AFTER_RETRIES=YES

If a user has lock_after_retries set to "no", update the user's attributes using the command:

# usermod -K lock_after_retries=yes [username]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_SPARC_V3R6_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CAT|II, CCI|CCI-000044, Rule-ID|SV-216334r958388_rule, STIG-ID|SOL-11.1-040140, STIG-Legacy|SV-61117, STIG-Legacy|V-48245, Vuln-ID|V-216334

Plugin: Unix

Control ID: 718232caafef68c03fa4a41942076b8eb2d3d0098ae3250c5040a64d8424e6a0