TMA-FLASHARRAY-1.7
Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks
HighLevel 1Automatedflasharray
Description
FlashArray supports a password policy for administrative user passwords. It allows rules to be configured governing complexity requirements, such as minimum length, number of required unique character groups (e.g. letters, numbers, symbols), and whether a user's username may appear in their password. Passes when the password policy shows Minimum Password Length 8 or more, Minimum Character Groups 3 or more, and Enforce Dictionary Check and Enforce Username Check True. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).
How it is checked
Audit method: Configuration pattern
- Pattern
(?is)(?:min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b)
How it is fixed
Fix method: Guidance or infrastructure patch
To align with the security recommendations, configure the global password policy to mandate longer passwords, require multiple character groups, and prevent the use of easily guessable dictionary words or usernames. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Set the Minimum Password Length to 8 (or more). ; Set the Minimum Character Groups to 3. ; Ensure the toggles for Enforce Username Check and Enforce Dictionary Check are enabled. ; Click Save. From the CLI: ; Configure Length and Complexity: Set the minimum password length and character group requirements using the purepolicy password setattr command.
Properties
- Operating systems
- Any
- Tags
- flasharraystorageaccess-control
- Reference
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.7 Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target flasharray