Pure Storage FlashArray
TMA-FLASHARRAY-1.3
Ensure only authorized local administrative accounts exist and a local emergency-access account is retained
說明
If your environment does not possess any mechanisms for delegated account management, or you have a need for additional local accounts for use as service accounts or for handling administration during network outages, FlashArray supports creating additional local administrative accounts. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
檢查方式
稽核方法: 人工審核
From the CLI: ; Run the command pureadmin list to enumerate all local administrator accounts. ; Review the output to confirm each account has a documented business justification and is actively required.
修補方式
修補方法: 操作指南或基礎設施修補檔
To align with the security recommendations, delete any local user accounts that are no longer authorized to access the FlashArray. Always ensure you maintain at least one local emergency access account with array_admin privileges in the event directory services or SAML become unavailable. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit (three vertical dots) icon for the user account you want to remove and select Delete User.... ; In the Delete User pop-up window, click Delete to confirm. From the CLI: ; Delete an unauthorized or stale account using the pureadmin delete command. ; Command Syntax: pureadmin delete <USERNAME>
屬性
- 作業系統
- 不限
- 標籤
- flasharraystorageaccess-control
- 參考資料
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.3 Ensure only authorized local administrative accounts exist and a local emergency-access account is retained