← Back to F5 BIG-IP TMOS NDM Security Technical Implementation Guide

V-266069

CAT II (Medium)

The F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes.

Rule ID

SV-266069r1024600_rule

STIG

F5 BIG-IP TMOS NDM Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000044

Discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

Check Content

From the BIG-IP GUI:
1. System.
2. Users.
3. Authentication.
4. Verify Maximum Login Failures set to "3".
5. Verify User Lockout set to "Automatically enable locked-out user after 900 seconds".

From the BIG-IP console, type the following command:

tmsh list auth password-policy max-login-failures

Note: Check for a value of "3".

tmsh list auth password-policy lockout-duration

Note: Check for a value of "900".

If the BIG-IP appliance is not configured to enforce the limit of three consecutive invalid logon attempts and lock out users for 900 seconds, this is a finding.

Fix Text

From the BIG-IP GUI:
1. System.
2. Users.
3. Authentication.
4. Set Maximum Login Failures to "3".
5. Set User Lockout to "Automatically enable locked-out user after 900 seconds".
6. Update.

From the BIG-IP console, type the following commands:

tmsh modify auth password-policy max-login-failures 3
tmsh modify auth password-policy lockout-duration 900
tmsh save sys config