TMA-OCI-1.7
Ensure MFA is enabled for all users with a console password
Description
Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity. With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that ... Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources. Every active user that may use a console password must have mfa-status ENROLLED. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
How it is checked
Audit method: Shell command
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
out=$(oci identity-domains users list --endpoint "$u" --all --attributes 'userName,active,urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User:canUseConsolePassword' --query 'data.resources[?active==`true` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-capabilities-user"."can-use-console-password"!=`false` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-mfa-user"."mfa-status"!=`"ENROLLED"`]."user-name"' --raw-output 2>/dev/null) || exit 1
printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|no MFA ($u): |"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Enable MFA in each domain's sign-on policy (Security > Sign-on policies > rule: prompt for an additional factor) and have the listed users enrol a factor.
Properties
- Operating systems
- Any
- Tags
- ociiam
- Reference
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.7 Ensure MFA is enabled for all users with a console password
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target oci