Ensure Password Account Lockout Threshold Is Configured

Méthode de vérification

Méthode d'audit: Commande shell

v=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - 2>/dev/null) || exit 1
v=$(printf '%s\n' "$v" | /usr/bin/head -1)
if [ -n "$v" ] && [ "$v" -le 5 ]; then echo compliant; else echo "policyAttributeMaximumFailedAuthentications=${v:-unset}"; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Terminal Method: Run the following command to set the maximum number of failed login attempts to less than or equal to 5: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=<value≤5>" example: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=5" Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.mobiledevice.passwordpolicy 2. The key to include is maxFailedAttempts 3. The key must be set to <integer><value≤5></integer> Note: The profile method is the preferred method for setting password policy since - setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release. Note: This is for the login password only and does not affect the timeout of FileVault.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target macos