← Back to AvePoint Fly Server Security Technical Implementation Guide

V-283926

CAT II (Medium)

Fly Server must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.

Rule ID

SV-283926r1206132_rule

STIG

AvePoint Fly Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000044 CCI-002238 CCI-002361 CCI-004045

Discussion

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-APP-000065, SRG-APP-000345, SRG-APP-000295, SRG-APP-000317

Check Content

Check the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed. 
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Check the key "FailedLogOnLimitationCount".

If the value is not "3", this is a finding.

Fix Text

Configure the logon configuration in Fly Server Manager:
- Access the VM or server where the Fly Server manager is installed. 
- Find the installation location of Fly Server manager.
- Open the "TimerService.exe.config" file in ...\APElements\FLY\Manager\Control\bin.
- Find following node and set the value to "3":

<add key="FailedLogOnLimitationCount" value="3" />