From MAC OSX 10.6 Workstation Security Technical Implementation Guide
Part of OSX00050-Account lockout threshold
Associated with IA controls: ECLO-1, ECLO-2
The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of incorrect logon attempts should be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.
Open a terminal session and use the following command to view the setting for account lockout threshold. sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttempts If the value of "maxFailedLoginAttempts" is more than "3", or set to "0", this is a finding.
Open a terminal session and use the following command to set the value for account lockout threshold. sudo pwpolicy -n -setglobalpolicy "maxFailedLoginAttempts=3" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=3"
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer