TMA-FLASHARRAY-1.6
Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Description
FlashArray supports controls to prevent brute-force guessing of passwords. These controls cause a user to be locked out after a configurable number of consecutive failed password attempts. The lockout lasts for a configurable duration of time. Everpure recommends the following: Passes when the management password policy shows Maximum Login Attempts 1-3 and Lockout Duration of at least 60 minutes (60m, 1h, 1d or the equivalent seconds/milliseconds). The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).
Méthode de vérification
Méthode d'audit: Motif de configuration
- Motif
(?is)(?:max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b.*lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b|lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b.*max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b)
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
To align with the security recommendations, configure the global password policy to enforce brute-force lockout protections and ensure the policy is actively enabled. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Modify the password policy settings: set the Maximum Login Attempts to 3 and the Lockout Duration to 60 (minutes). ; Ensure the policy is toggled to Enabled and click Save. (Note: If a legitimate administrator is inadvertently locked out, you must unlock their account manually from the CLI, as there is no specific GUI toggle documented for unlocking accounts in 6.9.x). From the CLI:
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- flasharraystorageaccess-control
- Référence
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.6 Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target flasharray