The F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes.

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

From the BIG-IP GUI: 1. System. 2. Users. 3. Authentication. 4. Verify Maximum Login Failures set to "3". 5. Verify User Lockout set to "Automatically enable locked-out user after 900 seconds".

From the BIG-IP console, type the following command:

tmsh list auth password-policy max-login-failures

Note: Check for a value of "3".

tmsh list auth password-policy lockout-duration

Note: Check for a value of "900".

If the BIG-IP appliance is not configured to enforce the limit of three consecutive invalid logon attempts and lock out users for 900 seconds, this is a finding.

From the BIG-IP GUI: 1. System. 2. Users. 3. Authentication. 4. Set Maximum Login Failures to "3". 5. Set User Lockout to "Automatically enable locked-out user after 900 seconds". 6. Update.

From the BIG-IP console, type the following commands:

tmsh modify auth password-policy max-login-failures 3 tmsh modify auth password-policy lockout-duration 900 tmsh save sys config