The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.fso.hpux11:def:25
# The system must disable accounts after three consecutive unsuccessful logon attempts.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# System is in Trusted Mode
# file_object (file_test)
test_1() {
test -e '/tcb' &>/dev/null
}
# Ensure that u_maxtries in /tcb/files/auth/system/default is greater than zero and less than or equal to 3.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/:u_maxtries#(-?[0-9]+):/\1/p' '/tcb/files/auth/system/default') | grep -Pq '^([1-3])$'
}
# System is NOT in Trusted Mode (SMSE)
# file_object (file_test)
test_3() {
test -e '/tcb' &>/dev/null
}
# Ensure that AUTH_MAXTRIES in /etc/default/security is greater than zero and less than or equal to 2.
# textfilecontent54_object (textfilecontent54_test)
test_4() {
(sed -En 's/^\s*AUTH_MAXTRIES[\s]*=[\s]*([0-9]+)/\1/p' '/etc/default/security') | grep -Pq '^([1-2])$'
}
# Ensure that AUTH_MAXTRIES in /var/adm/userdb is greater than zero and less than or equal to 2.
# textfilecontent54_object (textfilecontent54_test)
test_5() {
(grep -rhP --include='*' 'AUTH_MAXTRIES\s*=\s*([0-9]+)' '/var/adm/userdb' | sed -En 's/AUTH_MAXTRIES\s*=\s*([0-9]+)/\1/p') | grep -Pq '^([1-2])$'
}
if ( ( test_1 && test_2 ) || ( test_3 && test_4 && test_5 ) ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# oval:mil.disa.fso.hpux11:def:25
if [ -e /tcb/files/auth/system/default ]; then
if grep -qE '^:u_maxtries#[1-3]:' /tcb/files/auth/system/default; then
echo "PASS"
exit 0
else
echo "FAIL"
exit 1
fi
elif [ ! -e /tcb ]; then
if [ -e /etc/default/security ]; then
if grep -qE '^\\s*AUTH_MAXTRIES[\\s]*=[\\s]*([1-2])' /etc/default/security; then
echo "PASS"
exit 0
else
echo "FAIL"
exit 1
fi
elif [ -e /var/adm/userdb ]; then
if grep -qE '^\\s*AUTH_MAXTRIES[\\s]*=[\\s]*([1-2])' /var/adm/userdb/*; then
echo "PASS"
exit 0
else
echo "FAIL"
exit 1
fi
else
echo "PASS"
exit 0
fi
else
echo "FAIL"
exit 1
fi