Detections
Analytics

AOSX-10-001326 - System must automatically lock the account until it is released by an administrator - 'minutesUntilFailedLoginReset'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Setting a lockout expiration of 15 minutes is an effective deterrent against brute forcing that also makes allowances for legitimate mistakes by users.

Solution

To set the password policy without a configuration profile, run the following command to save a copy of the current pwpolicy account policy file:

sudo pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist

Open the generated file in a text editor and ensure it contains the following text after the opening <dict> tag and before the closing </dict> tag.

Replace <dict/> first with <dict></dict> if necessary.

<key>policyCategoryAuthentication</key>
<array>
<dict>
<key>policyContent</key>
<string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string>
<key>policyIdentifier</key>
<string>Authentication Lockout</string>
<key>policyParameters</key>
<dict>
<key>autoEnableInSeconds</key>
<integer>900</integer>
<key>policyAttributeMaximumFailedAuthentications</key>
<integer>3</integer>
</dict>
</dict>
</array>

If the line <key>policyCategoryAuthentication</key> already exists, the following text should be used instead and inserted after the first <array> tag that follows it:

<dict>
<key>policyContent</key>
<string>(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))</string>
<key>policyIdentifier</key>
<string>Authentication Lockout</string>
<key>policyParameters</key>
<dict>
<key>autoEnableInSeconds</key>
<integer>900</integer>
<key>policyAttributeMaximumFailedAuthentications</key>
<integer>3</integer>
</dict>
</dict>

After saving the file and exiting to the command prompt, run the following command to load the new policy file:

sudo pwpolicy setaccountpolicies pwpolicy.plist

NOTE: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration or bugs in OS X may block password change and local user creation operations, as well as, lock out all local users, including administrators.

See Also

http://iasecontent.disa.mil/stigs/zip/U_Apple_OS_X_10-10_Workstation_V1R5_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7, CAT|II, CCI|CCI-002238, Rule-ID|SV-74197r2_rule, STIG-ID|AOSX-10-001326, Vuln-ID|V-59767

Plugin: Unix

Control ID: 0d3d42180bd0a84cf42797ba684ff16cccf4093cbb71d7bacdd58a16ea4cdfd9