The A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

From A10 Networks ADC NDM Security Technical Implementation Guide

Associated with: CCI-002238

SV-82563r1_rule The A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

Vulnerability discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.

Check content

Attempt to log on to an administrator account three times. On each attempt, deliberately enter an incorrect password. Attempt to log on a fourth time with a correct password. If the attempt succeeds, this is a finding. This can also be verified using the following command to view the lockout status of all administrative accounts: show admin detail If the Lock Status is not Locked, this is a finding.

Fix text

Use the following command to enable admin lockout: admin lockout enable The following command locks the admin account after three failed logon attempts sets the A10 ADC to remember the last failed logon for 15 minutes. admin lockout threshold 3 admin lockout reset-time 15 Use the following command to enable admin lockout: admin lockout enable The following command keeps a locked admin account locked until it is manually unlocked by an authorized admin: admin lockout duration 0

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.