Ensure administrators and directory groups are granted least- privilege roles via management access policies

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Run the command pureadmin list to display all local administrators. ; Review the Access Policy column in the output to confirm that each account has the appropriate minimum-privilege policy attached (and no account is unnecessarily set to array_admin). ; Run the command pureds role list to display the current LDAP/AD group to Purity//FA access policy mappings and verify their assignments. ; Run purepolicy management-access list to inspect the permissions, scopes, and aggregation strategies of all configured access policies.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, assign users and groups the minimum role needed to accomplish their responsibilities by leveraging Purity//FA's built-in or custom Management Access Policies. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; For Local Users: In the Users panel, click the edit (three vertical dots) icon for the user account and select Change Access Policy. Remove any overly permissive policies and assign the appropriate minimum-privilege policy. ; For Directory Service Groups: In the Directory Service panel, click the edit icon in the Roles section.