From swells at redhat.com Thu Aug 20 11:31:24 2015 Content-Type: multipart/mixed; boundary="===============4493275601490046893==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] added new Rule and check to disable inactive accounts * inactivity is defined as time following automatic password expiration * also added relevant CCI refs Date: Thu, 28 Jun 2012 12:27:14 -0400 Message-ID: <9C859DCA-24F5-4FFB-9FB6-8EC15FEB95EC@redhat.com> In-Reply-To: 4FEC5E31.1020406@eclipse.ncsc.mil --===============4493275601490046893== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ack -- Shawn Wells Technical Director, U.S. Intelligence Programs (e) shawn(a)redhat.com (c) 443-534-0130 On Jun 28, 2012, at 9:38 AM, Jeffrey Blank wrote: > We want to have them edit this text file since we want the setting to > apply to ALL accounts by default when they are created. > = > Running chage on one account just sets it for that one account at that ti= me. > = > That said, I can amend my commit prior to push to mention the existence > of chage in the enclosing , so that the information is there. > = > Sound good? > = > = > = > On 06/27/2012 06:45 PM, Shawn Wells wrote: >> On 6/27/12 6:35 PM, Jeffrey Blank wrote: >>> + >>> +Set Account Expiration Following Inactivity >>> +To specify the number of days after a password expires >>> +(which signifies inactivity) until an >>> +account is permanently disabled, edit the file >>> /etc/defaults/useradd >>> +and add or correct the following lines, substituting >>> NUM_DAYS appropriately: >>> +
INACTIVE=3DNUM_DAYS
>>> +A value of 35 is recommended. If a password is currently on the >>> +verge of expiration, then 35 days remain until the account is >>> automatically >>> +disabled. However, if the password will not expire for another 60 >>> days, then 95 >>> +days could elapse until the account would be automatically disabled. >>> See the >>> +useradd man page for more information. Determining the >>> inactivity >>> +timeout must be done with careful consideration of the length of a >>> "normal" >>> +period of inactivity for users in the particular environment. Setting >>> +the timeout too low incurs support costs and also has the potential >>> to impact >>> +availability of the system to legitimate users. >>> +
>>> + >> = >> nitpick. kinda. >> = >> do we want to have them edit text files, or just issue a chage command a= la >> # chage -I 35 shawn >> = >> ^ that's an uppercase i >> = >> and the idea of using this concept as the definition of 'inactive >> account' is novel, I haven't thought of this before! >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://fedorahosted.org/mailman/listinfo/scap-security-guide > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide --===============4493275601490046893==--