Ensure Password History Is Set to at least 24

AltaNivel 1Automatizadamacos

Descripción

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users must reset passwords periodically. Audit: policyAttributePasswordHistoryDepth must be >= 24 (the benchmark script only tests >= 1; the title value of 24 is enforced here).

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | /usr/bin/grep -A1 policyAttributePasswordHistoryDepth | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1)
case "$p" in ''|*[!0-9]*) echo "history=${p:-unset}";; *) if [ "$p" -ge 24 ]; then echo true; else echo "history=$p"; fi;; esac

Salida esperada: true

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Profile (preferred): com.apple.mobiledevice.passwordpolicy pinHistory = <integer><value≥24></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=<value≥24>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=24".

Propiedades

Sistemas operativos: macos-26
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.8 Ensure Password History Is Set to at least 24

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos