5.2 Use LockOut Realms

Information

A LockOut realm wraps around standard realms adding the ability to lock a user out after multiple failed logins.

Rationale:

Locking out a user after multiple failed logins slows down attackers from brute forcing logins.

Solution

Create a lockout realm wrapping the main realm similar to the example below:

<Realm className='org.apache.catalina.realm.LockOutRealm'
failureCount='3' lockOutTime='600' cacheSize='1000'
cacheRemovalWarningTime='3600'>
<Realm
className='org.apache.catalina.realm.DataSourceRealm'
dataSourceName=... />
</Realm>

See Also

https://workbench.cisecurity.org/benchmarks/11652

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Unix

Control ID: 5b21092fc5f4a656a8ca861f28738525c8ef75624d5a803e3b88c05f92d78640