Set Password Expiration Parameters on Active Accounts

ВысокийУровень 1Автоматическаяsolaris

Описание

The characteristics of an operating system that make 'user identification' via password a secure and workable solution is the combination of settings chosen. The commands for this item set all active accounts (except the root account) to force password changes every 91 days (13 weeks), and then prevent password changes for seven days (one week), thereafter. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Как проверяется

Метод проверки: Команда оболочки

shell

command -v logins >/dev/null 2>&1 || exit 1; out=$( { logins -ox | awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && ( $10 < 7 || $11 > 91 || $12 < 7 )) { print }'; grep -q "^MAXWEEKS=13$" /etc/default/passwd || echo "MAXWEEKS is not 13"; grep -q "^MINWEEKS=1$" /etc/default/passwd || echo "MINWEEKS is not 1"; grep -q "^WARNWEEKS=4$" /etc/default/passwd || echo "WARNWEEKS is not 4" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Perform the following to implement the recommended state: # logins -ox | awk -F: '($1 == "root" || $8 == "LK" || $8 == "NL") { next } ; { cmd = "passwd" } ; ($11 < 91) { cmd = cmd " -x 91" } ($10 < 7) { cmd = cmd " -n 7" } ($12 < 28) { cmd = cmd " -w 28" } (cmd != "passwd") { print cmd " " $1 }' > /etc/CISupd_accounts # /sbin/sh /etc/CISupd_accounts # rm -f /etc/CISupd_accounts # cd /etc/default # cp passwd passwd.orig # grep -v WEEKS passwd > passwd.CIS # cat <<EODefaults >> passwd.CIS MAXWEEKS=13 MINWEEKS=1 WARNWEEKS=1 EODefaults # mv passwd.CIS passwd

Свойства

Операционные системы: Любая
Теги: solarispassword-policy
Источник: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 7.1 Set Password Expiration Parameters on Active Accounts

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target solaris