TMA-OCI-1.6

Ensure IAM password policy prevents password reuse

AltaNível 1Automatizadaoci

Descrição

IAM password policies can prevent the reuse of a given password by the same user. It is recommended the password policy prevent the reuse of passwords. Enforcing password history ensures that passwords are not reused in for a certain period of time by the same user. If a user is not allowed to use last 24 passwords, that window of time is greater. Every password policy must have num-passwords-in-history of 24 or more. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Como é verificado

Método de auditoria: Comando shell

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
  d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
  ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
  n=$(oci identity-domains password-policies list --endpoint "$u" --query 'length(data.resources[?("num-passwords-in-history" || `0`) < `24`])' --raw-output 2>/dev/null) || exit 1
  [ "$n" -eq 0 ] 2>/dev/null || { echo "$n non-compliant password policies: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Set Previous passwords remembered to 24 or more in every identity domain password policy.

Propriedades

Sistemas operacionais: Qualquer
Tags: ociiam
Referência: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.6 Ensure IAM password policy prevents password reuse

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target oci