STIGQter: STIG Summary: A10 Networks ADC NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Apr 2016:

The A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

DISA Rule

SV-82563r1_rule

Vulnerability Number

V-68073

Group Title

SRG-APP-000345-NDM-000290

Rule Version

AADC-NM-000093

Severity

CAT II

CCI(s)

• CCI-002238 - The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Use the following command to enable admin lockout:
admin lockout enable

The following command locks the admin account after three failed logon attempts sets the A10 ADC to remember the last failed logon for 15 minutes.
admin lockout threshold 3
admin lockout reset-time 15

Use the following command to enable admin lockout:
admin lockout enable

The following command keeps a locked admin account locked until it is manually unlocked by an authorized admin:
admin lockout duration 0

Check Contents

Attempt to log on to an administrator account three times. On each attempt, deliberately enter an incorrect password. Attempt to log on a fourth time with a correct password.

If the attempt succeeds, this is a finding.

This can also be verified using the following command to view the lockout status of all administrative accounts:
show admin detail

If the Lock Status is not Locked, this is a finding.

Vulnerability Number

V-68073

Documentable

False

Rule Version

AADC-NM-000093

Severity Override Guidance

Attempt to log on to an administrator account three times. On each attempt, deliberately enter an incorrect password. Attempt to log on a fourth time with a correct password.

If the attempt succeeds, this is a finding.

This can also be verified using the following command to view the lockout status of all administrative accounts:
show admin detail

If the Lock Status is not Locked, this is a finding.

Check Content Reference

M

Target Key

2915

Comments