Ensure MFA is enabled for all users with a console password

ВисокаНиво 1Аутоматскаoci

Опис

Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity. With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that ... Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources. Every active user that may use a console password must have mfa-status ENROLLED. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Како се проверава

Метод провере: Команда љуске

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
  d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
  ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
  out=$(oci identity-domains users list --endpoint "$u" --all --attributes 'userName,active,urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User:canUseConsolePassword' --query 'data.resources[?active==`true` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-capabilities-user"."can-use-console-password"!=`false` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-mfa-user"."mfa-status"!=`"ENROLLED"`]."user-name"' --raw-output 2>/dev/null) || exit 1
  printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|no MFA ($u): |"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Enable MFA in each domain's sign-on policy (Security > Sign-on policies > rule: prompt for an additional factor) and have the listed users enrol a factor.

Својства

Оперативни системи: Било који
Ознаке: ociiam
Референца: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.7 Ensure MFA is enabled for all users with a console password

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target oci