TMA-FLASHARRAY-1.3
Ensure only authorized local administrative accounts exist and a local emergency-access account is retained
Описание
If your environment does not possess any mechanisms for delegated account management, or you have a need for additional local accounts for use as service accounts or for handling administration during network outages, FlashArray supports creating additional local administrative accounts. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
From the CLI: ; Run the command pureadmin list to enumerate all local administrator accounts. ; Review the output to confirm each account has a documented business justification and is actively required.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
To align with the security recommendations, delete any local user accounts that are no longer authorized to access the FlashArray. Always ensure you maintain at least one local emergency access account with array_admin privileges in the event directory services or SAML become unavailable. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit (three vertical dots) icon for the user account you want to remove and select Delete User.... ; In the Delete User pop-up window, click Delete to confirm. From the CLI: ; Delete an unauthorized or stale account using the pureadmin delete command. ; Command Syntax: pureadmin delete <USERNAME>
Свойства
- Операционные системы
- Любая
- Теги
- flasharraystorageaccess-control
- Источник
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.3 Ensure only authorized local administrative accounts exist and a local emergency-access account is retained