The DBN-6300 must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
An XCCDF Rule
Description
<VulnDiscussion>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. It is possible to set a time-to-retry variable, as well as number of retries during that lockout timeout variable, within the DBN-6300.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-79481r1_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Set a time-to-retry variable, as well as number of retries during that lockout timeout variable, within the DBN-6300 through the CLI.
This value is set with the following registry entry in the CLI:
reg set /sysconfig/auth/01 {"stores": { "local": { "policies": { "passwordFail": { "enable": true, "threshold": 3, "windowSeconds": 60 }}}}}