Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-47943 | SOL-11.1-040010 | SV-60815r1_rule | Medium |
Description |
---|
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. |
STIG | Date |
---|---|
Solaris 11 X86 Security Technical Implementation Guide | 2016-06-29 |
Check Text ( C-50379r2_chk ) |
---|
The root role is required. Determine if user passwords are properly configured to be changed every 56 days. # logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }' If output is returned, this is a finding. Check that /etc/default/password is configured to enforce password expiration every 56 days or less. # grep "^MAXWEEKS=" /etc/default/passwd If the command does not report MAXWEEKS=8 or less, this is a finding. |
Fix Text (F-51555r1_fix) |
---|
The User Security role is required. Change each username to enforce 56 day password changes. # pfexec passwd -x 56 [username] # pfedit /etc/default/passwd Search for MAXWEEKS. Change the line to read: MAXWEEKS=8 |