Ensure Password Age Is Configured

CaoCấp 1Tự độngmacos

Mô tả

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users should reset passwords periodically. This control uses 365 days as the acceptable value. Some organizations may be more or less restrictive. This control mainly exists to mitigate against password reuse of the macOS account password in other realms that may be more prone to compromise. Attackers take advantage of exposed information to attack other accounts. Passwords should be changed periodically to reduce exposure.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
val() { printf '%s\n' "$out" | /usr/bin/grep -A1 "$1" | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1; }
p1=$(val policyAttributeExpiresEveryNDays)
p2=$(val policyAttributeDaysUntilExpiration)
ok=false
case "$p1" in ''|*[!0-9]*) ;; *) [ "$p1" -le 365 ] && ok=true;; esac
case "$p2" in ''|*[!0-9]*) ;; *) [ "$p2" -le 365 ] && ok=true;; esac
echo "$ok"

Đầu ra mong đợi: true

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Terminal Method: Run the following command to require that passwords expire after at most 365 days: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=<value≤525600>" example: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=43200" Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.mobiledevice.passwordpolicy 2. The key to include is maxPINAgeInDays 3. The key must be set to <integer><value≥365></integer> Note: The profile method is the preferred method for setting password policy since - setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release.

Thuộc tính

Hệ điều hành: macos-14
Thẻ: authmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.2.7 Ensure Password Age Is Configured

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos