Ensure IAM password policy prevents password reuse

HighLevel 1Automatedoci

Description

IAM password policies can prevent the reuse of a given password by the same user. It is recommended the password policy prevent the reuse of passwords. Enforcing password history ensures that passwords are not reused in for a certain period of time by the same user. If a user is not allowed to use last 24 passwords, that window of time is greater. Every password policy must have num-passwords-in-history of 24 or more. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

How it is checked

Audit method: Shell command

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
  d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
  ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
  n=$(oci identity-domains password-policies list --endpoint "$u" --query 'length(data.resources[?("num-passwords-in-history" || `0`) < `24`])' --raw-output 2>/dev/null) || exit 1
  [ "$n" -eq 0 ] 2>/dev/null || { echo "$n non-compliant password policies: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set Previous passwords remembered to 24 or more in every identity domain password policy.

Properties

Operating systems: Any
Tags: ociiam
Reference: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.6 Ensure IAM password policy prevents password reuse

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target oci