From blank at eclipse.ncsc.mil Thu Aug 20 11:31:25 2015 Content-Type: multipart/mixed; boundary="===============3186851592285563596==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] added new Rule and check to disable inactive accounts * inactivity is defined as time following automatic password expiration * also added relevant CCI refs Date: Fri, 29 Jun 2012 14:07:30 -0400 Message-ID: <4FEDEEE2.8060909@eclipse.ncsc.mil> In-Reply-To: 9C859DCA-24F5-4FFB-9FB6-8EC15FEB95EC@redhat.com --===============3186851592285563596== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I just pushed with modification. Willy may want to update mappings to some combination of CCIs 15, 16, and 17 for some combinations of this new Group (account_expiration) and Rule (account_disable_post_pw_expiration). (And perhaps remove the "new rule needed" ref to CCI 17, and correct the closing-tag comments for the Groups in srg_support.xml). I figure it's easier to ask than to cross commits mid-stream... Thanks! On 06/28/2012 12:27 PM, Shawn Wells wrote: > Ack > = > -- > Shawn Wells > Technical Director, > U.S. Intelligence Programs > (e) shawn(a)redhat.com > (c) 443-534-0130 > = > On Jun 28, 2012, at 9:38 AM, Jeffrey Blank wro= te: > = >> We want to have them edit this text file since we want the setting to >> apply to ALL accounts by default when they are created. >> >> Running chage on one account just sets it for that one account at that t= ime. >> >> That said, I can amend my commit prior to push to mention the existence >> of chage in the enclosing , so that the information is there. >> >> Sound good? >> >> >> >> On 06/27/2012 06:45 PM, Shawn Wells wrote: >>> On 6/27/12 6:35 PM, Jeffrey Blank wrote: >>>> + >>>> +Set Account Expiration Following Inactivity >>>> +To specify the number of days after a password expires >>>> +(which signifies inactivity) until an >>>> +account is permanently disabled, edit the file >>>> /etc/defaults/useradd >>>> +and add or correct the following lines, substituting >>>> NUM_DAYS appropriately: >>>> +
INACTIVE=3DNUM_DAYS
>>>> +A value of 35 is recommended. If a password is currently on the >>>> +verge of expiration, then 35 days remain until the account is >>>> automatically >>>> +disabled. However, if the password will not expire for another 60 >>>> days, then 95 >>>> +days could elapse until the account would be automatically disabled. >>>> See the >>>> +useradd man page for more information. Determining the >>>> inactivity >>>> +timeout must be done with careful consideration of the length of a >>>> "normal" >>>> +period of inactivity for users in the particular environment. Setting >>>> +the timeout too low incurs support costs and also has the potential >>>> to impact >>>> +availability of the system to legitimate users. >>>> +
>>>> + >>> >>> nitpick. kinda. >>> >>> do we want to have them edit text files, or just issue a chage command = ala >>> # chage -I 35 shawn >>> >>> ^ that's an uppercase i >>> >>> and the idea of using this concept as the definition of 'inactive >>> account' is novel, I haven't thought of this before! >>> _______________________________________________ >>> scap-security-guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> https://fedorahosted.org/mailman/listinfo/scap-security-guide >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://fedorahosted.org/mailman/listinfo/scap-security-guide > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide --===============3186851592285563596==--