Set Retry Limit for Account Lockout

So wird geprüft

Prüfmethode: Shell-Befehl

r=compliant; grep -Eq "^RETRIES=[1-3]$" /etc/default/login 2>/dev/null || r="RETRIES is not 3 or less"; grep -q "^LOCK_AFTER_RETRIES=YES" /etc/security/policy.conf 2>/dev/null || r="LOCK_AFTER_RETRIES is not YES"; echo "$r"

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Perform the following to implement the recommended state: # cd /etc/default # awk '/RETRIES=/ { $1 = "RETRIES=3" } { print }' login >login.CIS # mv login.CIS login # cd /etc/security # awk '/LOCK_AFTER_RETRIES=/ { $1 = "LOCK_AFTER_RETRIES=YES" } { print }' policy.conf > policy.conf.CIS # mv policy.conf.CIS policy.conf # svcadm restart svc:/system/name-service/cache Be careful when enabling these settings as they can create a denial-of-service situation for legitimate users and applications. Account lockout can be disabled for specific users via the usermod command. For example, the following command disables account lock specifically for the oracle account: # usermod -K lock_after_retries=no oracle Note: The root role is configured in this manner by default to prevent accidental lock out.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target solaris