1

I administer seven Macs running a range of OS X 10.10 to macOS 10.13. The machine I use to administer them is running OS X 10.10.

All of the users are Standard accounts, with one Admin account which I use to administer the computers.

Is there a way to set an incorrect password lock out, which will only let you try more passwords if, a set time is elapsed, or the Admin user grants access again?

I would like to use the lockout as an additional layer of security from someone trying to brute force their way into a remote desktop session with a machine when the machine is on a public network (eg. hotel / airport etc).

  • Do you use macOS Server to manage the computers? – Jake3231 Feb 24 '18 at 14:26
  • @Jake3231 no, all the machines are setup with an admin account local to that machine, the admin account is only there to manage other user accounts on that machine and prevent standard users adding software etc. All the day to day users of the machines have "standard" privilege user accounts. The machines are centrally managed via apple remote desktop when changes need to be made, but there is no consolidated management like a MacOS server in place – sam Feb 24 '18 at 14:33
  • Thank you @sam. To my understanding, there is a password policy option in macOS Server, but I posted an answer that should allow you to achieve the same affect without macOS Server. – Jake3231 Feb 24 '18 at 14:58
3
+50

It turns out that you can use a Terminal command to achieve this. Note that parts of this command are deprecated, but I tested it on macOS 10.13.3 and everything seems to work.

  1. On the device that has the account you want to set a lock on, log into the administrator account.
  2. Open Terminal and enter the following command; pwpolicy -u testuser -setpolicy "maxFailedLoginAttempts=1". Assume that testuser is the short name of the user you want to apply the lockout settings to, and 1 is the number of failed attempts required to trigger the account lock.
  3. Restart the device to ensure that the changes take affect.

If an account is locked, you can log into the administrator account again and unlock the standard account using the following command; pwpolicy -u testuser -enableuser.

Update: I was able to test this with remote connections, and your device will not allow remote authentication with a locked account.

  • Thanks @Jake3231 my primary use for this would be to limit someone trying to brute force their way into a machine that have remote desktop control enabled. When on a non secure network. Eg. hotel / airport etc. Does the password lockout settings above work for both normal users logging in as well as remote desktop connections through ARD ? – sam Feb 24 '18 at 15:16
  • @sam This will certainly work for users attempting to physically log into the device, but I am not certain about any sort of remote login. I will update the answer if I find more information on that. – Jake3231 Feb 24 '18 at 15:18
  • @sam Just as an update, after looking online, it seems that this will help secure the account in terms of remote connections, but I have not tested this yet. – Jake3231 Feb 24 '18 at 15:22
  • @sam. It turns out that this will secure your account in terms of remote connections. I have updated the answer. – Jake3231 Feb 24 '18 at 15:33
  • thanks, out of interest what is the default password lockout policy in OSX ? – sam Feb 25 '18 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .