TMA-FLASHARRAY-1.7

Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

CaoCấp 1Tự độngflasharray

Mô tả

FlashArray supports a password policy for administrative user passwords. It allows rules to be configured governing complexity requirements, such as minimum length, number of required unique character groups (e.g. letters, numbers, symbols), and whether a user's username may appear in their password. Passes when the password policy shows Minimum Password Length 8 or more, Minimum Character Groups 3 or more, and Enforce Dictionary Check and Enforce Username Check True. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy password list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Cách kiểm tra

Phương pháp kiểm tra: Mẫu cấu hình

Mẫu khớp: (?is)(?:min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b|enforce[ _-]?username[ _-]?check[ \t]*[=:]?[ \t]*true.*enforce[ _-]?dictionary[ _-]?check[ \t]*[=:]?[ \t]*true.*min(?:imum)?[ _-]?character[ _-]?groups[ \t]*[=:]?[ \t]*[3-9]\b.*min(?:imum)?[ _-]?password[ _-]?length[ \t]*[=:]?[ \t]*(?:[89]|[1-9][0-9]+)\b)

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To align with the security recommendations, configure the global password policy to mandate longer passwords, require multiple character groups, and prevent the use of easily guessable dictionary words or usernames. From the GUI: ; Navigate to Settings > Access > Password Policy. ; Set the Minimum Password Length to 8 (or more). ; Set the Minimum Character Groups to 3. ; Ensure the toggles for Enforce Username Check and Enforce Dictionary Check are enabled. ; Click Save. From the CLI: ; Configure Length and Complexity: Set the minimum password length and character group requirements using the purepolicy password setattr command.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: flasharraystorageaccess-control
Tham chiếu: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.7 Ensure the password policy enforces 8+ characters, 3+ character groups, and username and dictionary checks

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target flasharray