What is the time period defined for failed “consecutive login” attempts on a Trusted system?

[Rich Fink]

Hi all,

My company is going through an internal security audit, and I’m trying to answer a specific question regarding Trusted HP-UX systems.

According to the documentation I’ve been able to find, after 5 unsuccessful *consecutive* login attempts, the user’s account is disabled. So far, so good.

My question is, what’s the timeframe that determines “consecutive” logins? Obviously, 5 right in a row will cause the account to be disabled. But what if you have 4 failures, and walk away? If the next try is an hour later, is that considered the 5th time? Is it 5 tries within a 24 hour period? Is there a timer that resets the “consecutive” counter?

Or does it not matter – 5 in a row, no matter the time separation, is considered 5 consecutive attempts?

I know it's an obscure question, but that's what audits are all about...

Thanks,

-Rich

[Tim Nelson · Accepted solution]

Failed login attempts are consecutive.

4 now and another a year from now is still 5.

The counter is only reset with a successful login.

I do not know if or where this would be documented. It is a common sense question. Perhaps the definition of consecutive could be used.

Dictionary.com defines this as:
1. following one another in uninterrupted succession or order; successive

Auditors, hmmmpf :)

[James George_1]

Yes, the 5th one is considered as consecutive attempt even if its after 6 months !!!

James

[Rich Fink]

Thanks y'all,

That pretty much confirms what I thought. Simply be definition, consecutive means in a row, without an implied time limit.

Will assign points shortly. Thanks again.

-Rich