TMA-OCI-1.7
Ensure MFA is enabled for all users with a console password
Mô tả
Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity. With MFA enabled in the IAM service, when a user signs in to Oracle Cloud Infrastructure, they are prompted for their user name and password, which is the first factor (something that ... Multi factor authentication adds an extra layer of security during the login process and makes it harder for unauthorized users to gain access to OCI resources. Every active user that may use a console password must have mfa-status ENROLLED. Evaluates every ACTIVE identity domain in the accessible compartments (oci iam domain list) via oci identity-domains. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
ds=""
for c in $comps; do
d=$(oci iam domain list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].url' --raw-output 2>/dev/null) || exit 1
ds="$ds $(printf '%s\n' "$d" | grep -o 'https://[^"]*')"
done
[ -n "$(printf '%s' "$ds" | tr -d ' ')" ] || exit 1
for u in $ds; do
out=$(oci identity-domains users list --endpoint "$u" --all --attributes 'userName,active,urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus,urn:ietf:params:scim:schemas:oracle:idcs:extension:capabilities:User:canUseConsolePassword' --query 'data.resources[?active==`true` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-capabilities-user"."can-use-console-password"!=`false` && "urn-ietf-params-scim-schemas-oracle-idcs-extension-mfa-user"."mfa-status"!=`"ENROLLED"`]."user-name"' --raw-output 2>/dev/null) || exit 1
printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|no MFA ($u): |"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Enable MFA in each domain's sign-on policy (Security > Sign-on policies > rule: prompt for an additional factor) and have the listed users enrol a factor.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- ociiam
- Tham chiếu
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.7 Ensure MFA is enabled for all users with a console password
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target oci