Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system has the correct setting for the number of permitted failed logon attempts:
/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxFailedAttempts
If the return is null, or not, "maxFailedAttempts = 3", this is a finding.
If password policy is set with the "pwpolicy" utility, the variable names may vary depending on how the policy was set. To check if the password policy is configured to disable an account for 15 minutes after 3 unsuccessful logon attempts, run the following command to output the password policy to the screen:
/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies
Look for the line "<key>policyCategoryAuthentication</key>".
If this does not exist, and password policy is not controlled by a directory service, this is a finding.
In the array that follows, there should be one or more <dict> sections that describe policy checks. One should contain a <string> that allows users to log on if "policyAttributeFailedAuthentications" is less than "policyAttributeMaximumFailedAuthentications". Under policyParameters, "policyAttributeMaximumFailedAuthentications" should be set to "3".
If "policyAttributeMaximumFailedAuthentications" is not set to "3", this is a finding.
In the same check or in another <dict> section, there should be a <string> that allows users to log on if the "policyAttributeCurrentTime" is greater than the result of adding "15" minutes (900 seconds) to "policyAttributeLastFailedAuthenticationTime". The check might use a variable defined in its policyParameters section.
If the check does not exist or if the check adds too great an amount of time, this is a finding.