Ensure Password Account Lockout Threshold Is Configured

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

v=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - 2>/dev/null) || exit 1
v=$(printf '%s\n' "$v" | /usr/bin/head -1)
if [ -n "$v" ] && [ "$v" -le 5 ]; then echo compliant; else echo "policyAttributeMaximumFailedAuthentications=${v:-unset}"; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Terminal Method: Run the following command to set the maximum number of failed login attempts to less than or equal to 5: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=<value≤5>" example: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=5" Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.mobiledevice.passwordpolicy 2. The key to include is maxFailedAttempts 3. The key must be set to <integer><value≤5></integer> Note: The profile method is the preferred method for setting password policy since - setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release. Note: This is for the login password only and does not affect the timeout of FileVault.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target macos