SV-216335r959010: The delay between login prompts following a failed login attempt must be at least 4 seconds. | Solaris 11 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The delay between login prompts following a failed login attempt must be at least 4 seconds.

Description

Discussion Text

As an immediate return of an error message, coupled with the capability to try again, may facilitate automatic and rapid-fire brute-force password attacks by a malicious user.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366SV-60915V-48043

References

DPMS Target Solaris 11 SPARC DISA DPMS Target Solaris 11 SPARC 4022

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.solaris11:def:39
# The delay between login prompts following a failed login attempt must be at least 4 seconds.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# SLEEPTIME is set to 4 or more in /etc/default/login
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  [ "$(sed -En 's/^\s*SLEEPTIME=(\d+)\s*$/\1/p' '/etc/default/login')" -ge 4 ]
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.fso.solaris11:def:39
if [ ! -f "/etc/default/login" ]; then echo "PASS"; exit 0; fi; cat /etc/default/login | grep -q "^\\s*SLEEPTIME=(\\d+)\\s*$" || echo "PASS"; exit 0; sleeptime=$(grep -oP "^\\s*SLEEPTIME=(\\d+)\\s*$" /etc/default/login | grep -o "(\\d+)"); if [ $sleeptime -ge 4 ]; then echo "PASS"; else echo "FAIL"; fi; exit 0

Remediation

The root role is required.

# pfedit the /etc/default/login 

Locate the line containing:

SLEEPTIME

Change the line to read:

SLEEPTIME=4