Fly Server must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.

Severity
Group ID
Group Title
Version
Rule ID
Date
STIG Version
mediumV-283926SRG-APP-000065FLYS-00-000020SV-283926r1206132_rule2026-06-151

Description

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-APP-000065, SRG-APP-000345, SRG-APP-000295, SRG-APP-000317

ℹ️ Check

Check the logon configuration in Fly Server Manager: - Access the VM or server where the Fly Server manager is installed. - Find the installation location of Fly Server manager. - Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin. - Check the key "FailedLogOnLimitationCount". If the value is not "3", this is a finding.

✔️ Fix

Configure the logon configuration in Fly Server Manager: - Access the VM or server where the Fly Server manager is installed. - Find the installation location of Fly Server manager. - Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin. - Find following node and set the value to "3": <add key="FailedLogOnLimitationCount" value="3" />