UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

User passwords must be changed at least every 56 days.


Overview

Finding ID Version Rule ID IA Controls Severity
V-47943 SOL-11.1-040010 SV-60815r1_rule Medium
Description
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password.
STIG Date
Solaris 11 X86 Security Technical Implementation Guide 2016-06-29

Details

Check Text ( C-50379r2_chk )
The root role is required.

Determine if user passwords are properly configured to be changed every 56 days.

# logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }'

If output is returned, this is a finding.

Check that /etc/default/password is configured to enforce password expiration every 56 days or less.

# grep "^MAXWEEKS=" /etc/default/passwd

If the command does not report MAXWEEKS=8 or less, this is a finding.
Fix Text (F-51555r1_fix)
The User Security role is required.

Change each username to enforce 56 day password changes.

# pfexec passwd -x 56 [username]

# pfedit /etc/default/passwd

Search for MAXWEEKS. Change the line to read:

MAXWEEKS=8