Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour

AltaNível 1Automatizadaflasharray

Descrição

FlashArray supports controls to prevent brute-force guessing of passwords. These controls cause a user to be locked out after a configurable number of consecutive failed password attempts. The lockout lasts for a configurable duration of time. Everpure recommends the following: Passes when the management password policy shows Maximum Login Attempts 1-3 and Lockout Duration of at least 60 minutes (60m, 1h, 1d or the equivalent seconds/milliseconds). The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Como é verificado

Método de auditoria: Padrão de configuração

Padrão: (?is)(?:max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b.*lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b|lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b.*max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, configure the global password policy to enforce brute-force lockout protections and ensure the policy is actively enabled. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Modify the password policy settings: set the Maximum Login Attempts to 3 and the Lockout Duration to 60 (minutes). ; Ensure the policy is toggled to Enabled and click Save. (Note: If a legitimate administrator is inadvertently locked out, you must unlock their account manually from the CLI, as there is no specific GUI toggle documented for unlocking accounts in 6.9.x). From the CLI:

Propriedades

Sistemas operacionais: Qualquer
Tags: flasharraystorageaccess-control
Referência: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.6 Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target flasharray