Details

By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Administration >> Single Sign-On >> Configuration >> Policies >> Lockout Policy.

Click ‘Edit’.

Set the ‘Maximum number of failed login attempts’ to ‘3’ and click ‘OK’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system VMware.

References

• 800-53|AC-7b.
• CAT|II
• CCI|CCI-002238
• Rule-ID|SV-243104r719555_rule
• STIG-ID|VCTR-67-000045
• Vuln-ID|V-243104

Source

• Tenable.com/audits