Detections
Analytics
AOSX-13-001324 - The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.
Information
Setting a lockout time period of 15 minutes is an effective deterrent against brute forcing that also makes allowances for legitimate mistakes by users. When three invalid logon attempts are made, the account will be locked.Solution
This setting may be enforced using the 'Passcode Policy' configuration profile or by a directory service.The following two lines within the configuration enforce lockout expiration to '15' minutes:
<key>autoEnableInSeconds</key>
<integer>900</integer>
To set the password policy without a configuration profile, run the following command to save a copy of the current 'pwpolicy' account policy file:
/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist
Open the generated file in a text editor and ensure it contains the following text after the opening <dict> tag and before the closing </dict> tag.
Replace <dict/> first with <dict></dict> if necessary.
<key>policyCategoryAuthentication</key>
<array>
<dict>
<key>policyContent</key>
<string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string>
<key>policyIdentifier</key>
<string>Authentication Lockout</string>
<key>policyParameters</key>
<dict>
<key>autoEnableInSeconds</key>
<integer>900</integer>
<key>policyAttributeMaximumFailedAuthentications</key>
<integer>3</integer>
</dict>
</dict>
</array>
If the line '<key>policyCategoryAuthentication</key>' already exists, the following text should be used instead and inserted after the first <array> tag that follows it:
<dict>
<key>policyContent</key>
<string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string>
<key>policyIdentifier</key>
<string>Authentication Lockout</string>
<key>policyParameters</key>
<dict>
<key>autoEnableInSeconds</key>
<integer>900</integer>
<key>policyAttributeMaximumFailedAuthentications</key>
<integer>3</integer>
</dict>
</dict>
After saving the file and exiting to the command prompt, run the following command to load the new policy file:
/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist
Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_OS_X_10-13_V2R5_STIG.zip
Item Details
Audit Name: DISA STIG Apple Mac OSX 10.13 v2r5
Category: ACCESS CONTROL
References: 800-53|AC-7b., CAT|II, CCI|CCI-002238, Rule-ID|SV-214920r609363_rule, STIG-ID|AOSX-13-001324, STIG-Legacy|SV-96435, STIG-Legacy|V-81721, Vuln-ID|V-214920
Plugin: Unix
Control ID: 90c82fd86f9eb4cea5795aaf352153ee5ed0edc9c1cccc88bd8ed1517c841373