Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour

VisokaNivo 1Automatskaflasharray

Opis

FlashArray supports controls to prevent brute-force guessing of passwords. These controls cause a user to be locked out after a configurable number of consecutive failed password attempts. The lockout lasts for a configurable duration of time. Everpure recommends the following: Passes when the management password policy shows Maximum Login Attempts 1-3 and Lockout Duration of at least 60 minutes (60m, 1h, 1d or the equivalent seconds/milliseconds). The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?is)(?:max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b.*lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b|lockout[ _-]?duration[ \t]*[=:]?[ \t]*(?:(?:[6-9][0-9]|[1-9][0-9]{2,})m|[1-9][0-9]*[hdw]|(?:36[0-9]{2}|3[7-9][0-9]{2}|[4-9][0-9]{3}|[1-9][0-9]{4,})s|(?:3[6-9][0-9]{5}|[4-9][0-9]{6}|[1-9][0-9]{7,}))\b.*max(?:imum)?[ _-]?login[ _-]?attempts[ \t]*[=:]?[ \t]*[1-3]\b)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To align with the security recommendations, configure the global password policy to enforce brute-force lockout protections and ensure the policy is actively enabled. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Modify the password policy settings: set the Maximum Login Attempts to 3 and the Lockout Duration to 60 (minutes). ; Ensure the policy is toggled to Enabled and click Save. (Note: If a legitimate administrator is inadvertently locked out, you must unlock their account manually from the CLI, as there is no specific GUI toggle documented for unlocking accounts in 6.9.x). From the CLI:

Svojstva

Operativni sistemi: Bilo koji
Oznake: flasharraystorageaccess-control
Referenca: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.6 Ensure brute-force lockout is set to 3 attempts with a lockout duration of at least 1 hour

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target flasharray