STIGQter: STIG Summary: F5 BIG-IP TMOS NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 02 Jul 2025:

The F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes.

DISA Rule

SV-266069r1024600_rule

Vulnerability Number

V-266069

Group Title

SRG-APP-000065-NDM-000214

Rule Version

F5BI-DM-300013

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. System.
2. Users.
3. Authentication.
4. Set Maximum Login Failures to "3".
5. Set User Lockout to "Automatically enable locked-out user after 900 seconds".
6. Update.

From the BIG-IP console, type the following commands:

tmsh modify auth password-policy max-login-failures 3
tmsh modify auth password-policy lockout-duration 900
tmsh save sys config

Check Contents

From the BIG-IP GUI:
1. System.
2. Users.
3. Authentication.
4. Verify Maximum Login Failures set to "3".
5. Verify User Lockout set to "Automatically enable locked-out user after 900 seconds".

From the BIG-IP console, type the following command:

tmsh list auth password-policy max-login-failures

Note: Check for a value of "3".

tmsh list auth password-policy lockout-duration

Note: Check for a value of "900".

If the BIG-IP appliance is not configured to enforce the limit of three consecutive invalid logon attempts and lock out users for 900 seconds, this is a finding.

Vulnerability Number

V-266069

Documentable

False

Rule Version

F5BI-DM-300013

Severity Override Guidance

From the BIG-IP GUI:
1. System.
2. Users.
3. Authentication.
4. Verify Maximum Login Failures set to "3".
5. Verify User Lockout set to "Automatically enable locked-out user after 900 seconds".

From the BIG-IP console, type the following command:

tmsh list auth password-policy max-login-failures

Note: Check for a value of "3".

tmsh list auth password-policy lockout-duration

Note: Check for a value of "900".

If the BIG-IP appliance is not configured to enforce the limit of three consecutive invalid logon attempts and lock out users for 900 seconds, this is a finding.

Check Content Reference

M

Target Key

5639