Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'

보통레벨 1자동oceanbase

설명

The FAILED_LOGIN_ATTEMPTS setting determines how many failed login attempts are permitted before the system locks the user's account. While different profiles can have different and more restrictive settings, such as USERS, the minimum(s) recommended here should be set on the DEFAULT profile. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Oracle-mode tenant. Passes when the DEFAULT profile FAILED_LOGIN_ATTEMPTS is 5 or less (UNLIMITED fails). Runs obclient against an Oracle-mode tenant using the connection options in OB_ORA_CONN (default "-h127.0.0.1 -P2881 -uSYS@oracle"); supply the password via OB_ORA_CONN (-p...) or ~/.my.cnf.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(obclient ${OB_ORA_CONN:--h127.0.0.1 -P2881 -uSYS@oracle} -N -B -e "SELECT CASE WHEN LIMIT NOT IN ('UNLIMITED', 'DEFAULT') AND TO_NUMBER(LIMIT) <= 5 THEN 'compliant' ELSE 'noncompliant' END FROM SYS.DBA_PROFILES WHERE PROFILE = 'DEFAULT' AND RESOURCE_NAME = 'FAILED_LOGIN_ATTEMPTS'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS 5; (and for every other profile in use).

속성

운영 체제: 모두
태그: oceanbaseauthenticationoracle-mode
참고 자료: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 5.1.1 Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oceanbase