Enforce lockout after 5 or 3 failed password attempts on the SSH login on the HMC

In order to meet Lloyd’s security standards users should be locked out after 5 failed password attempts (for normal accounts) and 3 (for privileged accounts) on the SSH login on the HMC.

We want it to perform a temporary lockout, as it does for the Web GUI.

IBM development team have confirmed that the option to turn this setting on is not available as it is a custom login shell and providing an CLI SSH lockout is not currently in their development plan.

Lloyds will need to raise a Security Non-Compliance (SNC) against the HMC config workbook. To close this SNC and remediate this risk we need the IBM development to address this configuration and bring this in as part of the development plan.

The specifics that our security team are after, standards-wise are:

• configurable number of failed passwords (when logging in with the same user account) i.e. we need 3 for privileged account access versus 5 for normal user access

• Configurable lockout duration after x failed pwd logins (e.g. 1 minute or 60 minutes etc.). After lock-out duration has expired, the counter is reset to 0 and login is enabled again.

• Also a configurable period of time so that the counter resets to 0 after a period of time. (This is to avoid a DoS situation where there are 2 failed login attempts [with a lockout set to 3 failed attempts], and a third failed attempt is attempted much later e.g. next day. If the counter is still at 2, that would immediately lock out the account. We don’t want that!)