← Back to IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide

V-255729

CAT II (Medium)

The MQ Appliance network device must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.

Rule ID

SV-255729r960840_rule

STIG

IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000044

Discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced.

Check Content

Log on to the MQ Appliance WebGUI as a privileged user. Go to Administration (gear icon) >> Access >> RBM Settings. 

Verify the Authentication Method is set to LDAP. 

Review LDAP server settings and verify the LDAP configuration limits three consecutive invalid logon attempts by a user during a 15-minute time period 

If MQ is not set to LDAP authentication or if LDAP is not configured to meet the requirement, this is a finding.

Fix Text

Log on to the MQ Appliance WebGUI as a privileged user. Go to Administration (gear icon) >> Access >> RBM Settings. 

Set Authentication Method to LDAP. 
Configure LDAP connection as required. 

Note: Enforcing the limit of three consecutive invalid logon attempts during a 15-minute time period is the responsibility of the LDAP server.