Oracle Solaris
TMA-SOLARIS-6.6
Set Delay between Failed Login Attempts to 4
Description
The SLEEPTIME variable in the /etc/default/login file controls the number of seconds to wait before printing the "login incorrect" message when a bad password is provided. The default value for SLEEPTIME is 4 seconds. As an immediate return of an error message, coupled with the capability to try again may facilitate automatic and rapid-fire brute-force password attacks by a malicious user, this delay time should be set as appropriate to the needs of the user. Audit: SLEEPTIME must be 4 or left commented out (default 4).
How it is checked
Audit method: File pattern
- File
/etc/default/login- Pattern
(?m)^SLEEPTIME=(?:[^4\n]|4\S)
How it is fixed
Fix method: Guidance or infrastructure patch
Perform the following to implement the recommended state: # cd /etc/default # cp login login.orig # awk '/SLEEPTIME=/ { $1 = "SLEEPTIME=4" } { print }' login > login.CIS # mv login.CIS login
Properties
- Operating systems
- Any
- Tags
- solarisaccounts
- Reference
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.6 Set Delay between Failed Login Attempts to 4
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target solaris