Details
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.
Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128
Solution
From the command prompt, execute the following command to configure the number of unsuccessful logins resulting in account lockout for ‘default:’ stanza in ‘/etc/security/user’ file:
# chsec -f /etc/security/user -s default -a loginretries=3
From the command prompt, execute the following command to configure the number of unsuccessful logins resulting in account lockout for all users who have loginretries values that are 0 or greater than 3:
# chsec -f /etc/security/user -s [user_name] -a loginretries=3
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.
References
- 800-53|AC-7a.
- 800-53|AC-7b.
- CAT|II
- CCI|CCI-000044
- CCI|CCI-002238
- Rule-ID|SV-215171r508663_rule
- STIG-ID|AIX7-00-001003
- STIG-Legacy|SV-101319
- STIG-Legacy|V-91219
- Vuln-ID|V-215171