The macOS system must enforce account lockout after the limit of three consecutive invalid logon attempts by a user.
From Apple OS X 10.13 Security Technical Implementation Guide
Part of SRG-OS-000021-GPOS-00005
Associated with:
CCI-000044
SV-96437r1_rule
The macOS system must enforce account lockout after the limit of three consecutive invalid logon attempts by a user.
Vulnerability discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.
Check content
Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system has the correct setting for the number of permitted failed logon attempts:
/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxFailedAttempts
If the return is null, or not, “maxFailedAttempts = 3”, this is a finding.
If password policy is set with the "pwpolicy" utility, the variable names may vary depending on how the policy was set. To check if the password policy is configured to disable an account for 15 minutes after 3 unsuccessful logon attempts, run the following command to output the password policy to the screen:
/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies
Look for the line "policyCategoryAuthentication".
If this does not exist, and password policy is not controlled by a directory service, this is a finding.
In the array that follows, there should be one or more sections that describe policy checks. One should contain a that allows users to log on if "policyAttributeFailedAuthentications" is less than "policyAttributeMaximumFailedAuthentications". Under policyParameters, "policyAttributeMaximumFailedAuthentications" should be set to "3".
If "policyAttributeMaximumFailedAuthentications" is not set to "3", this is a finding.
In the same check or in another section, there should be a that allows users to log on if the "policyAttributeCurrentTime" is greater than the result of adding "15" minutes (900 seconds) to "policyAttributeLastFailedAuthenticationTime". The check might use a variable defined in its policyParameters section.
If the check does not exist or if the check adds too great an amount of time, this is a finding.
Fix text
This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service.
To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file:
/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist
Open the generated file in a text editor and ensure it contains the following text after the opening tag and before the closing tag. Replace first with if necessary.
policyCategoryAuthentication
policyContent
(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))
policyIdentifier
Authentication Lockout
policyParameters
autoEnableInSeconds
900
policyAttributeMaximumFailedAuthentications
3
If the line "policyCategoryAuthentication" already exists, the following text should be used instead and inserted after the first tag that follows it:
policyContent
(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))
policyIdentifier
Authentication Lockout
policyParameters
autoEnableInSeconds
900
policyAttributeMaximumFailedAuthentications
3
After saving the file and exiting to the command prompt, run the following command to load the new policy file:
/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist
policyCategoryAuthentication
policyContent
(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))
policyIdentifier
Authentication Lockout
policyParameters
autoEnableInSeconds
900
policyAttributeMaximumFailedAuthentications
3
If the line policyCategoryAuthentication already exists, the following text should be used instead and inserted after the first tag that follows it:
policyContent
(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))
policyIdentifier
Authentication Lockout
policyParameters
autoEnableInSeconds
900
policyAttributeMaximumFailedAuthentications
3
After saving the file and exiting to the command prompt, run the following command to load the new policy file:
/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist
Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration or bugs in OS X may block password change and local user creation operations, as well as lock out all local users, including administrators.
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer