TMA-OCI-1.7
Ensure MFA is enabled for all users with a console password
Opis
Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity. With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that ... Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources. Every active user that may use a console password must have mfa-status ENROLLED. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
Kako se proverava
Metod provere: Komanda ljuske
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
out=$(oci identity-domains users list --endpoint "$u" --all --attributes 'userName,active,urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User:canUseConsolePassword' --query 'data.resources[?active==`true` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-capabilities-user"."can-use-console-password"!=`false` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-mfa-user"."mfa-status"!=`"ENROLLED"`]."user-name"' --raw-output 2>/dev/null) || exit 1
printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|no MFA ($u): |"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Enable MFA in each domain's sign-on policy (Security > Sign-on policies > rule: prompt for an additional factor) and have the listed users enrol a factor.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- ociiam
- Referenca
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.7 Ensure MFA is enabled for all users with a console password
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target oci