Ensure Password History Is Set to at least 24

CaoCấp 1Tự độngmacos

Mô tả

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users must reset passwords periodically. This control ensures that previous passwords are not reused immediately by keeping a history of previous password hashes. Ensure that password history checks are part of the password policy on the computer. This control checks whether a new password is different than the previous 24. The latest NIST guidance based on exploit research referenced in this section details how one of the greatest risks is password exposure rather than password cracking. Passwords should be changed to a new unique value whenever a password might have been exp...

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | /usr/bin/grep -A1 policyAttributePasswordHistoryDepth | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1)
case "$p" in ''|*[!0-9]*) echo "history=${p:-unset}";; *) if [ "$p" -ge 24 ]; then echo true; else echo "history=$p"; fi;; esac

Đầu ra mong đợi: true

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Terminal Method: Run the following command to require that the password must be different from at least the last 24 passwords: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=<value≥24>" example: % /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=24" Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.mobiledevice.passwordpolicy 2. The key to include is pinHistory 3. The key must be set to <integer><value≥24></integer> Note: The profile method is the preferred method for setting password policy since - setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release.

Thuộc tính

Hệ điều hành: macos-14
Thẻ: authmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.2.8 Ensure Password History Is Set to at least 24

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos