TMA-FLASHARRAY-1.3
Ensure only authorized local administrative accounts exist and a local emergency-access account is retained
설명
If your environment does not possess any mechanisms for delegated account management, or you have a need for additional local accounts for use as service accounts or for handling administration during network outages, FlashArray supports creating additional local administrative accounts. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From the CLI: ; Run the command pureadmin list to enumerate all local administrator accounts. ; Review the output to confirm each account has a documented business justification and is actively required.
조치 방법
조치 방식: 가이드 또는 인프라 패치
To align with the security recommendations, delete any local user accounts that are no longer authorized to access the FlashArray. Always ensure you maintain at least one local emergency access account with array_admin privileges in the event directory services or SAML become unavailable. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit (three vertical dots) icon for the user account you want to remove and select Delete User.... ; In the Delete User pop-up window, click Delete to confirm. From the CLI: ; Delete an unauthorized or stale account using the pureadmin delete command. ; Command Syntax: pureadmin delete <USERNAME>
속성
- 운영 체제
- 모두
- 태그
- flasharraystorageaccess-control
- 참고 자료
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.3 Ensure only authorized local administrative accounts exist and a local emergency-access account is retained