Ensure Password Age Is Configured

VisokaNivo 1Automatskamacos

Opis

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users should reset passwords periodically. This control uses 365 days as the acceptable value. Audit: policyAttributeExpiresEveryNDays or policyAttributeDaysUntilExpiration must be <= 365.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
val() { printf '%s\n' "$out" | /usr/bin/grep -A1 "$1" | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1; }
p1=$(val policyAttributeExpiresEveryNDays)
p2=$(val policyAttributeDaysUntilExpiration)
ok=false
case "$p1" in ''|*[!0-9]*) ;; *) [ "$p1" -le 365 ] && ok=true;; esac
case "$p2" in ''|*[!0-9]*) ;; *) [ "$p2" -le 365 ] && ok=true;; esac
echo "$ok"

Očekivani izlaz: true

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Profile (preferred): com.apple.mobiledevice.passwordpolicy maxPINAgeInDays = <integer><value≥365></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=<value≤525600>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=43200".

Svojstva

Operativni sistemi: macos-26
Oznake: macossystem-access
Referenca: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.7 Ensure Password Age Is Configured

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target macos