Ensure Password History Is Set to at least 24

高等級 1自動化macos

說明

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users must reset passwords periodically. Audit: policyAttributePasswordHistoryDepth must be >= 24 (the benchmark script only tests >= 1; the title value of 24 is enforced here).

檢查方式

稽核方法: Shell 指令

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | /usr/bin/grep -A1 policyAttributePasswordHistoryDepth | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1)
case "$p" in ''|*[!0-9]*) echo "history=${p:-unset}";; *) if [ "$p" -ge 24 ]; then echo true; else echo "history=$p"; fi;; esac

預期輸出: true

修補方式

修補方法: 操作指南或基礎設施修補檔

Profile (preferred): com.apple.mobiledevice.passwordpolicy pinHistory = <integer><value≥24></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=<value≥24>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=24".

屬性

作業系統: macos-15
標籤: macossystem-access
參考資料: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.2.8 Ensure Password History Is Set to at least 24

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos