TMA-FLASHARRAY-1.6
Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Deskripsi
FlashArray supports controls to prevent brute-force guessing of passwords. These controls cause a user to be locked out after a configurable number of consecutive failed password attempts. The lockout lasts for a configurable duration of time. Everpure recommends the following: Passes when the management password policy shows Maximum Login Attempts 1-3 and Lockout Duration of at least 60 minutes (60m, 1h, 1d or the equivalent seconds/milliseconds). The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).
Cara pemeriksaan
Metode audit: Pola konfigurasi
- Pola
(?is)(?:max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b.*lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b|lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b.*max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b)
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
To align with the security recommendations, configure the global password policy to enforce brute-force lockout protections and ensure the policy is actively enabled. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Modify the password policy settings: set the Maximum Login Attempts to 3 and the Lockout Duration to 60 (minutes). ; Ensure the policy is toggled to Enabled and click Save. (Note: If a legitimate administrator is inadvertently locked out, you must unlock their account manually from the CLI, as there is no specific GUI toggle documented for unlocking accounts in 6.9.x). From the CLI:
Properti
- Sistem operasi
- Apa saja
- Tag
- flasharraystorageaccess-control
- Referensi
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.6 Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target flasharray