Set Retry Limit for Account Lockout

Méthode de vérification

Méthode d'audit: Commande shell

r=compliant; grep -Eq "^RETRIES=[1-3]$" /etc/default/login 2>/dev/null || r="RETRIES is not 3 or less"; grep -q "^LOCK_AFTER_RETRIES=YES" /etc/security/policy.conf 2>/dev/null || r="LOCK_AFTER_RETRIES is not YES"; echo "$r"

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Perform the following to implement the recommended state: # cd /etc/default # awk '/RETRIES=/ { $1 = "RETRIES=3" } { print }' login >login.CIS # mv login.CIS login # cd /etc/security # awk '/LOCK_AFTER_RETRIES=/ { $1 = "LOCK_AFTER_RETRIES=YES" } { print }' policy.conf > policy.conf.CIS # mv policy.conf.CIS policy.conf # svcadm restart svc:/system/name-service/cache Be careful when enabling these settings as they can create a denial-of-service situation for legitimate users and applications. Account lockout can be disabled for specific users via the usermod command. For example, the following command disables account lock specifically for the oracle account: # usermod -K lock_after_retries=no oracle Note: The root role is configured in this manner by default to prevent accidental lock out.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target solaris