Ensure administrator password retries and lockout time are configured

높음레벨 1자동fortiswitch

설명

Failed login attempts can indicate malicious attempts to gain access to your network. To prevent this security risk, FortiSwitch is preconfigured to limit the number of failed administrator login attempts. After the maximum number of failed login attempts is reached, access to the account is blocked for the configured lockout period. PASS requires admin-lockout-threshold of 3 or less and admin-lockout-duration of 900 seconds or less, exactly as the CIS audit states (the CIS remediation value is 900). Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^config system global\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-threshold [1-3][ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-duration (?:[1-9]\d?|[1-8]\d\d|900)[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-duration (?:[1-9]\d?|[1-8]\d\d|900)[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-threshold [1-3][ \t]*$)

조치 방법

조치 방식: 가이드 또는 인프라 패치

config system global set admin-lockout-threshold 3 set admin-lockout-duration 900 end # CIS guidance: To configure the lockout options, from CLI: config system global set admin-lockout-threshold 3 set admin-lockout-duration 900 end Lockout affects the offending IP address, not the entire account.

속성

운영 체제: 모두
태그: fortiswitchauthentication
참고 자료: CIS FortiSwitch Benchmark v1.0.0 - 1.1.1 Ensure administrator password retries and lockout time are configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target fortiswitch