Ensure Password Account Lockout Threshold Is Configured

高等級 1自動化macos

說明

The account lockout threshold specifies the amount of times a user can enter an incorrect password before a lockout will occur. Ensure that a lockout threshold is part of the password policy on the computer. Audit: policyAttributeMaximumFailedAuthentications must be set and <= 5.

檢查方式

稽核方法: Shell 指令

shell

v=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - 2>/dev/null) || exit 1
v=$(printf '%s\n' "$v" | /usr/bin/head -1)
if [ -n "$v" ] && [ "$v" -le 5 ]; then echo compliant; else echo "policyAttributeMaximumFailedAuthentications=${v:-unset}"; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Profile (preferred): com.apple.mobiledevice.passwordpolicy maxFailedAttempts = <integer><value≤5></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=<value≤5>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=5".

屬性

作業系統: macos-26
標籤: macossystem-access
參考資料: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.1 Ensure Password Account Lockout Threshold Is Configured

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos