Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

AltaNivel 1Automatizadaflasharray

Descripción

FlashArray supports a password policy for administrative user passwords. It allows rules to be configured governing complexity requirements, such as minimum length, number of required unique character groups (e.g. letters, numbers, symbols), and whether a user's username may appear in their password. Passes when the password policy shows Minimum Password Length 8 or more, Minimum Character Groups 3 or more, and Enforce Dictionary Check and Enforce Username Check True. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?is)(?:min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To align with the security recommendations, configure the global password policy to mandate longer passwords, require multiple character groups, and prevent the use of easily guessable dictionary words or usernames. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Set the Minimum Password Length to 8 (or more). ; Set the Minimum Character Groups to 3. ; Ensure the toggles for Enforce Username Check and Enforce Dictionary Check are enabled. ; Click Save. From the CLI: ; Configure Length and Complexity: Set the minimum password length and character group requirements using the purepolicy password setattr command.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: flasharraystorageaccess-control
Referencia: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.7 Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target flasharray