TMA-OCI-1.7
Ensure MFA is enabled for all users with a console password
Deskripsi
Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity. With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that ... Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources. Every active user that may use a console password must have mfa-status ENROLLED. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
Cara pemeriksaan
Metode audit: Perintah shell
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
out=$(oci identity-domains users list --endpoint "$u" --all --attributes 'userName,active,urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User:canUseConsolePassword' --query 'data.resources[?active==`true` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-capabilities-user"."can-use-console-password"!=`false` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-mfa-user"."mfa-status"!=`"ENROLLED"`]."user-name"' --raw-output 2>/dev/null) || exit 1
printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|no MFA ($u): |"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Enable MFA in each domain's sign-on policy (Security > Sign-on policies > rule: prompt for an additional factor) and have the listed users enrol a factor.
Properti
- Sistem operasi
- Apa saja
- Tag
- ociiam
- Referensi
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.7 Ensure MFA is enabled for all users with a console password
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target oci