Ensure minimum days between password changes is 7 or more

НизкийУровень 2Ручная проверкаcos

Описание

The PASS_MIN_DAYS parameter in /etc/login.defs allows an administrator to prevent users from changing their password until a minimum number of days have passed since the last time the user changed their password. It is recommended that PASS_MIN_DAYS parameter be set to 7 or more days. By restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Run the following command and verify PASS_MIN_DAYS conforms to site policy (no less than 7 days): # grep PASS_MIN_DAYS /etc/login.defs PASS_MIN_DAYS 7 Run the following command and Review list of users and PAS_MIN_DAYS to Verify that all users' PAS_MIN_DAYS conform s to site policy (no less than 7 days): # grep -E ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1,4 <user>:<PASS_MIN_DAYS>

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Set the PASS_MIN_DAYS parameter to 7 in /etc/login.defs : PASS_MIN_DAYS 7 Modify user parameters for all users with a password set to match: # chage --mindays 7 <user>

Свойства

Операционные системы: Любая
Теги: authcontainer-optimized-oscos
Источник: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.3.1.2 Ensure minimum days between password changes is 7 or more