Ensure Password Minimum Length Is Configured

高レベル 1自動macos

説明

A minimum password length is the fewest number of characters a password can contain to meet a system's requirements. Ensure that a minimum of a 15-character password is part of the password policy on the computer. Where the confidentiality of encrypted information in FileVault is more of a concern, requiring a longer password or passphrase may be sufficient rather than imposing additional complexity requirements that may be self-defeating. Information systems that are not protected with strong password schemes including passwords of minimum length provide a greater opportunity for attackers to crack the password and gain access to the system.

チェック方法

監査方法: シェルコマンド

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
n=$(printf '%s\n' "$out" | /usr/bin/grep -e "policyAttributePassword matches" | /usr/bin/grep -oE '\{[0-9]+,' | /usr/bin/tr -d '{,' | /usr/bin/sort -n | /usr/bin/tail -1)
m=$(printf '%s\n' "$out" | /usr/bin/grep -A1 -E 'minimumLength|minChars' | /usr/bin/grep -oE '<integer>[0-9]+' | /usr/bin/tr -dc '0-9\n' | /usr/bin/sort -n | /usr/bin/tail -1)
[ -n "$m" ] && { [ -z "$n" ] || [ "$m" -gt "$n" ]; } && n=$m
if [ -n "$n" ] && [ "$n" -ge 15 ]; then echo compliant; else echo "minimum length=${n:-unset}"; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Terminal Method: Run the following command to set the password length to greater than or equal to 15: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "minChars=<value≥15>" example: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "minChars=15" Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.mobiledevice.passwordpolicy 2. The key to include is minLength 3. The key must be set to <integer><value≥15></integer> Note: The profile method is the preferred method for setting password policy since - setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release.

プロパティ

オペレーティングシステム: macos-14
タグ: authmacossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.2.2 Ensure Password Minimum Length Is Configured

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target macos