TMA-FLASHARRAY-1.3
Ensure only authorized local administrative accounts exist and a local emergency-access account is retained
Descrição
If your environment does not possess any mechanisms for delegated account management, or you have a need for additional local accounts for use as service accounts or for handling administration during network outages, FlashArray supports creating additional local administrative accounts. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
From the CLI: ; Run the command pureadmin list to enumerate all local administrator accounts. ; Review the output to confirm each account has a documented business justification and is actively required.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
To align with the security recommendations, delete any local user accounts that are no longer authorized to access the FlashArray. Always ensure you maintain at least one local emergency access account with array_admin privileges in the event directory services or SAML become unavailable. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit (three vertical dots) icon for the user account you want to remove and select Delete User.... ; In the Delete User pop-up window, click Delete to confirm. From the CLI: ; Delete an unauthorized or stale account using the pureadmin delete command. ; Command Syntax: pureadmin delete <USERNAME>
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- flasharraystorageaccess-control
- Referência
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.3 Ensure only authorized local administrative accounts exist and a local emergency-access account is retained