TMA-OCI-1.4

Ensure IAM password policy requires minimum length of 14 or greater

ВысокийУровень 1Автоматическаяoci

Описание

Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a certain length and are composed of certain characters. In keeping with the overall goal of having users create a password that is not overly weak, an eight-character minimum password length is recommended for an MFA account, and 14 characters for a password only account. Every password policy must have min-length >= 14 and min-numerals >= 1 or min-special-chars >= 1. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Как проверяется

Метод проверки: Команда оболочки

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
  d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
  ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
  n=$(oci identity-domains password-policies list --endpoint "$u" --query 'length(data.resources[?("min-length" || `0`) < `14` || (("min-numerals" || `0`) < `1` && ("min-special-chars" || `0`) < `1`)])' --raw-output 2>/dev/null) || exit 1
  [ "$n" -eq 0 ] 2>/dev/null || { echo "$n non-compliant password policies: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Identity > Domains > <domain> > Settings > Password policy: set Password length (minimum) to 14 and Numeric (minimum) or Special (minimum) to 1 for every policy (oci identity-domains password-policy patch/put).

Свойства

Операционные системы: Любая
Теги: ociiam
Источник: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.4 Ensure IAM password policy requires minimum length of 14 or greater

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target oci