TMA-FLASHARRAY-1.7

Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

ВисокаНиво 1Аутоматскаflasharray

Опис

FlashArray supports a password policy for administrative user passwords. It allows rules to be configured governing complexity requirements, such as minimum length, number of required unique character groups (e.g. letters, numbers, symbols), and whether a user's username may appear in their password. Passes when the password policy shows Minimum Password Length 8 or more, Minimum Character Groups 3 or more, and Enforce Dictionary Check and Enforce Username Check True. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Како се проверава

Метод провере: Образац конфигурације

Образац: (?is)(?:min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b)

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To align with the security recommendations, configure the global password policy to mandate longer passwords, require multiple character groups, and prevent the use of easily guessable dictionary words or usernames. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Set the Minimum Password Length to 8 (or more). ; Set the Minimum Character Groups to 3. ; Ensure the toggles for Enforce Username Check and Enforce Dictionary Check are enabled. ; Click Save. From the CLI: ; Configure Length and Complexity: Set the minimum password length and character group requirements using the purepolicy password setattr command.

Својства

Оперативни системи: Било који
Ознаке: flasharraystorageaccess-control
Референца: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.7 Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target flasharray