TMA-OCI-1.6
Ensure IAM password policy prevents password reuse
Descripción
IAM password policies can prevent the reuse of a given password by the same user. It is recommended the password policy prevent the reuse of passwords. Enforcing password history ensures that passwords are not reused in for a certain period of time by the same user. If a user is not allowed to use last 24 passwords, that window of time is greater. Every password policy must have num-passwords-in-history of 24 or more. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
Cómo se verifica
Método de auditoría: Comando de shell
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
n=$(oci identity-domains password-policies list --endpoint "$u" --query 'length(data.resources[?("num-passwords-in-history" || `0`) < `24`])' --raw-output 2>/dev/null) || exit 1
[ "$n" -eq 0 ] 2>/dev/null || { echo "$n non-compliant password policies: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set Previous passwords remembered to 24 or more in every identity domain password policy.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- ociiam
- Referencia
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.6 Ensure IAM password policy prevents password reuse
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target oci