Agreed. I'll use that value unless someone screams.

-Shawn

On 4/25/12 3:43 PM, Joe Wulf wrote:
Shawn,

90 days seems like a reasonable number.

R,
-Joe


From: Shawn Wells <shawn@redhat.com>
To: scap-security-guide@lists.fedorahosted.org
Sent: Wednesday, April 25, 2012 3:18 PM
Subject: Seeking Input: CCI-001459 Remediation - Temp Account Termination

Hey Guys,

    CCI-001459 requires that temp accounts be terminated after a organizationally defined period of time. Right now we don't have a check/control that implements that.

    I'd like to add prose that recommends that -ALL- accounts be locked after 60 (or  90... or 120..) days of inactivity. This would allow us to automatically meet CCI-001459 and enforces that inactive accounts should (eventually and automatically) be frozen.

    Thoughts? My thinking is that 90 days of inactivity is a good number.

-Shawn
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide