Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

ÉlevéeNiveau 1Automatiséeflasharray

Description

FlashArray supports a password policy for administrative user passwords. It allows rules to be configured governing complexity requirements, such as minimum length, number of required unique character groups (e.g. letters, numbers, symbols), and whether a user's username may appear in their password. Passes when the password policy shows Minimum Password Length 8 or more, Minimum Character Groups 3 or more, and Enforce Dictionary Check and Enforce Username Check True. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Méthode de vérification

Méthode d'audit: Motif de configuration

Motif: (?is)(?:min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b)

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To align with the security recommendations, configure the global password policy to mandate longer passwords, require multiple character groups, and prevent the use of easily guessable dictionary words or usernames. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Set the Minimum Password Length to 8 (or more). ; Set the Minimum Character Groups to 3. ; Ensure the toggles for Enforce Username Check and Enforce Dictionary Check are enabled. ; Click Save. From the CLI: ; Configure Length and Complexity: Set the minimum password length and character group requirements using the purepolicy password setattr command.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: flasharraystorageaccess-control
Référence: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.7 Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target flasharray