TMA-FLASHARRAY-1.6
Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Description
FlashArray supports controls to prevent brute-force guessing of passwords. These controls cause a user to be locked out after a configurable number of consecutive failed password attempts. The lockout lasts for a configurable duration of time. Everpure recommends the following: Passes when the management password policy shows Maximum Login Attempts 1-3 and Lockout Duration of at least 60 minutes (60m, 1h, 1d or the equivalent seconds/milliseconds). The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).
How it is checked
Audit method: Configuration pattern
- Pattern
(?is)(?:max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b.*lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b|lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b.*max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b)
How it is fixed
Fix method: Guidance or infrastructure patch
To align with the security recommendations, configure the global password policy to enforce brute-force lockout protections and ensure the policy is actively enabled. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Modify the password policy settings: set the Maximum Login Attempts to 3 and the Lockout Duration to 60 (minutes). ; Ensure the policy is toggled to Enabled and click Save. (Note: If a legitimate administrator is inadvertently locked out, you must unlock their account manually from the CLI, as there is no specific GUI toggle documented for unlocking accounts in 6.9.x). From the CLI:
Properties
- Operating systems
- Any
- Tags
- flasharraystorageaccess-control
- Reference
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.6 Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target flasharray