Ensure Password Age Is Configured

높음레벨 1자동macos

설명

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users should reset passwords periodically. This control uses 365 days as the acceptable value. Audit: policyAttributeExpiresEveryNDays or policyAttributeDaysUntilExpiration must be <= 365.

점검 방법

감사 방식: 셸 명령

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
val() { printf '%s\n' "$out" | /usr/bin/grep -A1 "$1" | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1; }
p1=$(val policyAttributeExpiresEveryNDays)
p2=$(val policyAttributeDaysUntilExpiration)
ok=false
case "$p1" in ''|*[!0-9]*) ;; *) [ "$p1" -le 365 ] && ok=true;; esac
case "$p2" in ''|*[!0-9]*) ;; *) [ "$p2" -le 365 ] && ok=true;; esac
echo "$ok"

예상 출력: true

조치 방법

조치 방식: 가이드 또는 인프라 패치

Profile (preferred): com.apple.mobiledevice.passwordpolicy maxPINAgeInDays = <integer><value≥365></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=<value≤525600>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=43200".

속성

운영 체제: macos-26
태그: macossystem-access
참고 자료: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.7 Ensure Password Age Is Configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target macos