-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/25/2012 01:22 PM, Shawn Wells wrote:
On 4/25/12 3:18 PM, Shawn Wells wrote:
> Hey Guys,
>
> CCI-001459 requires that temp accounts be terminated after a
> organizationally defined period of time. Right now we don't have
> a check/control that implements that.
>
> I'd like to add prose that recommends that -ALL- accounts be
> locked after 60 (or 90... or 120..) days of inactivity. This
> would allow us to automatically meet CCI-001459 and enforces that
> inactive accounts should (eventually and automatically) be
> frozen.
>
> Thoughts? My thinking is that 90 days of inactivity is a good
> number.
Sitting in a room with Willy Santos, and he just brought up a good
point. This really should be broken into 2 rules:
#1: All accounts should be disabled after 90 days inactivity
How do you measure activity? login? checked email? logged in via ftp?
Not all accounts are used to login. Also what happens if you use
central admin like ldap/etc.
#2: Temp accounts need to be chage'd to $creationDate+90 days
(procedurally). We could potentially identify temp accounts by
suggesting they all be created within a specific UID range, then we
can just chage on all UIDs within that range to verify temp
accounts do not exceed 90 days - This could be a problem if account
is "extended," we'll need to think through this...
Shouldn't they have created the temp account with an expiry date?
adduser
- -e, --expiredate EXPIRE_DATE
The date on which the user account will be disabled. The
date is specified in the format YYYY-MM-DD.
or use usermod with the same option to auto expire the account at date X?
_______________________________________________ scap-security-guide
mailing list scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPmFAeAAoJEBYNRVNeJnmT5N8P/jbibn5/2BH/v2gxb61/vJZ6
y4YtyNuGsfRJyGhv3KyG6gM0rX9dkZ5/aM+C3hBeSnpV4EXiHAFmB2Ud27639rkh
bDo0EMXtcLT816LtQcMGtHmzKWNCUNhevPec5knMa5MlSbQ0GL6EiKr7oA02P78/
TbZm8Dkp+OQQ0Wei8HCIAHlv0yUqyf/oqS6iscBfCQrhtdsdaTduca8dbBav/A89
gpdJ/H/sngnlkIyj5QRmav1ZRSbTrb3CJguc8UlvjSds3Tg/wzvE3SzAcrhr+LV+
8oodJ6ui70giir6YVzVNgM98en+34sIjAT5K1gT0v1mSKEFUEll7+VhHlKEceKNO
pc/DShneYoxd/EajXDU/B4LXuZzJfP/qkA2p+oqZojT0QbtA5Btu9DKqTyLtLUac
szTPDycly43uR30uybg/07gRzNE13Gwu4dZbI1T7h/tEVb8xHlvZZ+ezc/W525r2
Dq9f//rEFoOLJJoZif7gNXkYpl+F0MfnQ1jH4f4Ek1j+vBFw5jvMY44Tg0+uw72J
mNVnM1SPjuIgdcUjGxVrYHoGMwv8wrSubPKScez5hd7ma4r8vRvcjlpD6HeNJm3g
cNCGcv5xiQmSkIUvW3BPD7oQzL+/oLTMJPTFgkolGjOQ6zUDcNHWAGvqZG1wmHoc
qwSmTg84PXq3pz4qgA2c
=Qpwk
-----END PGP SIGNATURE-----