Free DISA STIG and SRG Library | Vaulted


The operating system must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

Finding ID
Rule ID
Cat II
Group Title
Target Key

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Setting a lockout expiration of 15 minutes is an effective deterrent against brute forcing that also makes allowances for legitimate mistakes by users.

Fix Text

To set the password policy without a configuration profile, run the following command to save a copy of the current pwpolicy account policy file: sudo pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist Open the generated file in a text editor and ensure it contains the following text after the opening &lt;<dict> tag and before the closing &lt;/</dict> tag. Replace &lt;<dict/> first with &lt;<dict>&lt;/></dict> if necessary. &lt;<key>policyCategoryAuthentication&lt;/</key> &lt;<array> &lt;<dict> &lt;<key>policyContent&lt;/</key> &lt;<string>(policyAttributeFailedAuthentications &lt;< policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))&lt;/</string> &lt;<key>policyIdentifier&lt;/</key> &lt;<string>Authentication Lockout&lt;/</string> &lt;<key>policyParameters&lt;/</key> &lt;<dict> &lt;<key>autoEnableInSeconds&lt;/</key> &lt;<integer>900&lt;/</integer> &lt;<key>policyAttributeMaximumFailedAuthentications&lt;/</key> &lt;<integer>3&lt;/</integer> &lt;/</dict> &lt;/</dict> &lt;/</array> If the line &lt;<key>policyCategoryAuthentication&lt;/</key> already exists, the following text should be used instead and inserted after the first &lt;<array> tag that follows it: &lt;<dict> &lt;<key>policyContent&lt;/</key> &lt;<string>(policyAttributeFailedAuthentications &lt;< policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))&lt;/</string> &lt;<key>policyIdentifier&lt;/</key> &lt;<string>Authentication Lockout&lt;/</string> &lt;<key>policyParameters&lt;/</key> &lt;<dict> &lt;<key>autoEnableInSeconds&lt;/</key> &lt;<integer>900&lt;/</integer> &lt;<key>policyAttributeMaximumFailedAuthentications&lt;/</key> &lt;<integer>3&lt;/</integer> &lt;/</dict> &lt;/</dict> After saving the file and exiting to the command prompt, run the following command to load the new policy file: sudo pwpolicy setaccountpolicies pwpolicy.plist NOTE: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration or bugs in OS X may block password change and local user creation operations, as well as, lock out all local users, including administrators.

Check Content

Password policy can be set with a configuration profile or the pwpolicy utility. If password policy is set with a configuration profile, run the following command to check if the system has the correct setting for the number of permitted failed logon attempts and the logon reset timer: system_profiler SPConfigurationProfileDataType | grep 'maxFailedAttempts\|minutesUntilFailedLoginReset' If 'maxFailedAttempts' is not set to '3' and 'minutesUntilFailedLoginReset is not set to '15', this is a finding. If password policy is set with the pwpolicy utility, the variable names may vary depending on how the policy was set. To check if the password policy is configured to disable an account for 15 minutes after 3 unsuccessful logon attempts, run the following command to output the password policy to the screen: sudo pwpolicy getaccountpolicies Look for the line '&lt;<key>policyCategoryAuthentication&lt;/</key>'. If this does not exist, and password policy is not controlled by a directory server, this is a finding. In the array that follows, there should be one or more &lt;<dict> sections that describe policy checks. One should contain a &lt;<string> that allows users to log on if 'policyAttributeFailedAuthentications' is less than 'policyAttributeMaximumFailedAuthentications'. Under policyParameters, policyAttributeMaximumFailedAuthentications should be set to 3. If 'policyAttributeMaximumFailedAuthentications' is not set to 3, this is a finding. In the same check or in another &lt;<dict> section, there should be a &lt;<string> that allows users to log on if the 'policyAttributeCurrentTime' is greater than the result of adding 15 minutes (900 seconds) to 'policyAttributeLastFailedAuthenticationTime'. The check might use a variable defined in its policyParameters section. If the check does not exist or if the check adds too great an amount of time, this is a finding.