← Back to IBM zVM Using CA VM:Secure Security Technical Implementation Guide

V-237901

CAT II (Medium)

The CA VM:Secure JOURNAL Facility parameters must be set for lockout after 3 attempts.

Rule ID

SV-237901r649543_rule

STIG

IBM zVM Using CA VM:Secure Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-000044

Discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.

Check Content

Examine VM:Secure Security Config File.

If there is no Journal record this is a finding.

If the Journal record has a maximum consecutive invalid password attempts set to 3, this is not a finding.

Note: The "warning" setting may be determined by the site but must be 3 or less.

Example:
JOURNAL 3 3

Fix Text

Edit the SECURITY CONFIG file:

vmsecure config security

Configure a JOURNAL record in the SECURITY CONFIG file as follows:

JOURNAL 3 3

Note: The "warning" setting may be determined by the site but must be 3 or less.