SV-38446r3: The delay between login prompts following a failed login attempt must be at least 4 seconds. | HP-UX 11.31 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The delay between login prompts following a failed login attempt must be at least 4 seconds.

Description

Discussion Text

<VulnDiscussion>Enforcing a delay between consecutive failed login attempts increases protection against automated password guessing attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations>GEN000480</Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl>Attack mitigations to minimize risk: 1. Ensure that the “nodelay” parameter is not found in the /etc/pam.conf file. 2. In the file /opt/ssh/etc/sshd_config, the “MaxAuthTries” attribute must be explicitly set to “1”. This attribute controls the maximum number of authentication attempts permitted per SSH daemon connection. 3. In the file /opt/ssh/etc/sshd_config, the “MaxStartups” attribute must be explicitly set to an organization defined value of “10” (the default) or less. This attribute controls the maximum number of unauthenticated connections to the SSH daemon. 4. IPFilter DCA mode is disabled by default, and must be explicitly enabled. Set the following attribute in the /etc/rc.config.d/ipfconf file: DCA_START=1 The below /etc/opt/ipf/ipf.conf file rule specifies a connection limit of “<limit>“ for all hosts when attempting to connect to port “<sshd port>“. The “<sshd port>“ and “<limit>“ must be set to organization defined values. Per vendor documentation, this rule must be the next-to-last rule in /etc/opt/ipf/ipf.conf. The final rule in the file must define the default connection limit. See the below example for the last 2 line entries in /etc/opt/ipf/ipf.conf (note that the double quotes are for emphasis only): “pass in proto tcp from any to any port = <sshd port> keep limit <limit>“ “block in from any to any” Save the file before exiting the editor. The system should not require restarting for the new rule(s) to take effect. </MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002238

References

DPMS Target HP-UX 11.31 DISA DPMS Target HP-UX 11.31 2171

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.hpux11:def:26
# The delay between login prompts following a failed login attempt must be at least 4 seconds.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# System is in Trusted Mode. Ensure that t_logdelay in /tcb/files/auth/system/default is greater than or equal to 4
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  [ "$(sed -En 's/:t_logdelay#(-?[0-9]+):/\1/p' '/tcb/files/auth/system/default')" -ge 4 ]
}
# System is NOT in Trusted Mode (SMSE). Remove instances of nodelay from /etc/pam.conf
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  ! ( grep -Pq '^[^#].*(\snodelay)' '/etc/pam.conf' &>/dev/null )
}

if ( test_1 || test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.hpux11:def:26

if grep -qE '^trusted_mode = yes$' /etc/system; then
    logdelay=$(grep -oE ':t_logdelay#(-?[0-9]+):' /tcb/files/auth/system/default | grep -oE '[0-9]+')
    if [ "$logdelay" -ge 4 ]; then
        echo "PASS"
        exit 0
    else
        echo "FAIL"
        exit 1
    fi
else
    if grep -qE '^[^#].*(\\snodelay)' /etc/pam.conf; then
        echo "FAIL"
        exit 1
    else
        echo "PASS"
        exit 0
    fi
fi

Remediation

For Trusted Mode:
Use the SAM/SMH interface to ensure that the t_logdelay setting is 4.

For SMSE:
There is no fix, however, there are attack mitigations to minimize risk (see mitigations).