TMA-CHECKPOINT-1.9
Ensure Days of non-use before lock-out is set to 30
Descrição
Days of non-use before lock-out. The number of days in which a user has not (successfully) logged in before that user is locked out. This only takes effect if Deny access to unused accounts is selected. PASS requires deny-on-nonuse allowed-days of 30 or less. Audited against the Gaia clish 'show configuration' output (run 'show configuration' in clish on each gateway and management server and save the full output).
Como é verificado
Método de auditoria: Padrão de configuração
- Padrão
(?m)^set password-controls deny-on-nonuse allowed-days (?:[1-9]|[12]\d|30)[ \t]*$
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
set password-controls deny-on-nonuse allowed-days 30 save config # CIS guidance: Run the following command to set the deny-on-nonuse allowed-days setting. CLI: set password-controls deny-on-nonuse allowed-days 30 GUI: Navigate to User Management > Password Policy > Deny access to unused accounts: Set 'Days of non-use before lock-out' to 30 or less. Note: This setting only takes effect if 'Deny access to unused accounts' is enabled.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- checkpointhardening
- Referência
- CIS Check Point Firewall Benchmark v1.1.0 - 1.9 Ensure Days of non-use before lock-out is set to 30
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target checkpoint