Ensure Maximum number of failed attempts allowed is set to 5 or fewer

高等級 1自動化checkpoint

說明

This only takes effect if Deny access after failed attempts is enabled. The number of failed login attempts that a user is allowed before being locked out. After making that many successive failed attempts, future attempts will fail. When one login attempt succeeds, counting of failed attempts stops, and the count is reset to zero. PASS requires deny-on-fail failures-allowed of 5 or fewer. Audited against the Gaia clish 'show configuration' output (run 'show configuration' in clish on each gateway and management server and save the full output).

檢查方式

稽核方法: 設定正規表示式

比對模式: (?m)^set password-controls deny-on-fail failures-allowed [1-5][ \t]*$

修補方式

修補方法: 操作指南或基礎設施修補檔

set password-controls deny-on-fail failures-allowed 5 save config # CIS guidance: Run the following command to set the deny-on-fail failures-allowed setting. CLI: set password-controls deny-on-fail failures-allowed 5 GUI: Navigate to User Management > Password Policy > Deny Access After Failed Login Attempts: checked and set ' Maximum number of failed attempts allowed is set to' setting to 5 or fewer.

屬性

作業系統: 不限
標籤: checkpointhardening
參考資料: CIS Check Point Firewall Benchmark v1.1.0 - 1.12 Ensure Maximum number of failed attempts allowed is set to 5 or fewer

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target checkpoint