Ensure 'PASSWORD_GRACE_TIME' Is LESS than or Equal to '5'

BajaNivel 1Revisión manualoceanbase

Descripción

The PASSWORD_GRACE_TIME setting determines how many days can pass after the user's password expires before the user's login capability is automatically locked out. The suggested value for this is five days or less.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

In the Oracle-mode tenant run SELECT PROFILE, RESOURCE_NAME, LIMIT FROM SYS.DBA_PROFILES WHERE PROFILE = 'DEFAULT' AND RESOURCE_NAME = 'PASSWORD_GRACE_TIME'; The value must be 5 (days) or less; UNLIMITED is a finding. Check other profiles in use the same way.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remediate this setting by executing the following SQL statement for each PROFILE returned by the audit procedure. ALTER PROFILE <profile_name> LIMIT PASSWORD_GRACE_TIME 5;

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: oceanbaseauthenticationoracle-mode
Referencia: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 5.1.4 Ensure 'PASSWORD_GRACE_TIME' Is LESS than or Equal to '5'