Host must lock an account after a specified number of failed login attempts

How it is checked

Audit method: Shell command

out=$(esxcli system settings advanced list -o /Security/AccountLockFailures 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Security/AccountLockFailures: no integer value'; exit 1 ;; esac
if [ "$v" -eq 5 ]; then echo compliant; else echo "/Security/AccountLockFailures = $v (expected 5)"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

To set the maximum failed login attempts correctly, perform the following steps: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter Security.AccountLockFailures in the filter. 5. Set the value for this parameter to 5. Alternately, use the following PowerCLI command: Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures | Set- AdvancedSetting -Value 5

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target vmware