cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

Lock a remote user account based on LDAP after X login failures.

Emerson_Juan_da
Nimbostratus
Nimbostratus

In order to be compliance with PCI standars we have to apply a lock account after X login failures.

 

Our environment has two BIG IP VE - Adv WAF in Sync-Only mode and they are using remote authentication based on LDAP (Windows AD).

 

How can we achieve the desired state? Is it possible while using remote authentication?

 

We checked the article below, but it seems not to work for our scenario.

https://support.f5.com/csp/article/K15497

 

Thank you.

4 REPLIES 4

I think that your windows team can do this if you want to protect your F5 devices:

 

 

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-threshold

 

 

 

 

For using the ASM to protect the websites use "brute force attack protection":

 

 

https://support.f5.com/csp/article/K54335130

Emerson_Juan_da
Nimbostratus
Nimbostratus

Hi Nikoolayy1,

 

Thank you for the answers provided previously.

 

We already tried to use "Account Lockout" policy on our Active Directory, but no luck with that since this policy applies only to computer and not users. May I know if it worked for you? Maybe we are configuring it wrongly.

 

Have a good one.

Emerson

Aha you are having a complex issue. Except the windows to make a powershell script or other kind of automation that uses GPO policy after it sees n number of faulty attempts in the active directory logs I don't know any other way. This is an interesting article about this:

 

 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/007db067-d0b6-4ee6-8fee-ae14e251a121/lock-ad-user?forum=winserverGP

Emerson_Juan_da
Nimbostratus
Nimbostratus

Nikoolayy1,

 

Thank you! I really appreciated your help on this. I am discussing what you have suggested internally with my team mates in order to check if it feasible.

 

Have a good one.