TMA-AIX-5.2.6

Ensure password expiration is configured

HighLevel 1Automatedaix

Description

The maximum password age attribute (maxage) determines the maximum number of weeks that you can use a password before you must change it. The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. Audit: reads `lssec -f /etc/security/user -s default -a maxage`.

How it is checked

Audit method: Shell command

shell

command -v lssec >/dev/null 2>&1 || exit 1; out=$(lssec -f /etc/security/user -s default -a maxage 2>/dev/null) || exit 1; v=$(printf '%s\n' "$out" | sed -n 's/.*maxage=\([^ ]*\).*/\1/p'); if [ -n "$v" ] && [ "$v" -ge 1 ] && [ "$v" -le 52 ]; then echo compliant; else echo "maxage=$v"; fi

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

chsec -f /etc/security/user -s default -a maxage=52

Properties

Operating systems: Any
Tags: aixpassword-policy
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 5.2.6 Ensure password expiration is configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix