TMA-OCI-1.5

Ensure IAM password policy expires passwords within 365 days

ВысокийУровень 1Автоматическаяoci

Описание

IAM password policies can require passwords to be rotated or expired after a given number of days. It is recommended that the password policy expire passwords after 365 and are changed immediately based on events. Excessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. Every password policy must have password-expires-after between 1 and 365 days (unset/0 means passwords never expire). Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Как проверяется

Метод проверки: Команда оболочки

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
  d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
  ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
  n=$(oci identity-domains password-policies list --endpoint "$u" --query 'length(data.resources[?("password-expires-after" || `0`) < `1` || "password-expires-after" > `365`])' --raw-output 2>/dev/null) || exit 1
  [ "$n" -eq 0 ] 2>/dev/null || { echo "$n non-compliant password policies: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Set Expires after (days) to 365 or less in every identity domain password policy.

Свойства

Операционные системы: Любая
Теги: ociiam
Источник: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.5 Ensure IAM password policy expires passwords within 365 days

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target oci