Ensure Password History Is Set to at least 24

ÉlevéeNiveau 1Automatiséemacos

Description

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users must reset passwords periodically. Audit: policyAttributePasswordHistoryDepth must be >= 24 (the benchmark script only tests >= 1; the title value of 24 is enforced here).

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | /usr/bin/grep -A1 policyAttributePasswordHistoryDepth | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1)
case "$p" in ''|*[!0-9]*) echo "history=${p:-unset}";; *) if [ "$p" -ge 24 ]; then echo true; else echo "history=$p"; fi;; esac

Sortie attendue: true

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Profile (preferred): com.apple.mobiledevice.passwordpolicy pinHistory = <integer><value≥24></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=<value≥24>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=24".

Propriétés

Systèmes d'exploitation: macos-26
Étiquettes: macossystem-access
Référence: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.8 Ensure Password History Is Set to at least 24

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos