Ensure Password History Is Set to at least 24

YüksekDüzey 1Otomatikmacos

Açıklama

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users must reset passwords periodically. Audit: policyAttributePasswordHistoryDepth must be >= 24 (the benchmark script only tests >= 1; the title value of 24 is enforced here).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | /usr/bin/grep -A1 policyAttributePasswordHistoryDepth | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1)
case "$p" in ''|*[!0-9]*) echo "history=${p:-unset}";; *) if [ "$p" -ge 24 ]; then echo true; else echo "history=$p"; fi;; esac

Beklenen çıktı: true

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Profile (preferred): com.apple.mobiledevice.passwordpolicy pinHistory = <integer><value≥24></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=<value≥24>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=24".

Özellikler

İşletim sistemleri: macos-26
Etiketler: macossystem-access
Referans: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.8 Ensure Password History Is Set to at least 24

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target macos