Seeking Input: CCI-001459 Remediation - Temp Account Termination

Shawn Wells shawn at redhat.com
Wed Apr 25 19:22:24 UTC 2012


On 4/25/12 3:18 PM, Shawn Wells wrote:
> Hey Guys,
>
>     CCI-001459 requires that temp accounts be terminated after a 
> organizationally defined period of time. Right now we don't have a 
> check/control that implements that.
>
>     I'd like to add prose that recommends that -ALL- accounts be 
> locked after 60 (or  90... or 120..) days of inactivity. This would 
> allow us to automatically meet CCI-001459 and enforces that inactive 
> accounts should (eventually and automatically) be frozen.
>
>     Thoughts? My thinking is that 90 days of inactivity is a good number. 

Sitting in a room with Willy Santos, and he just brought up a good 
point. This really should be broken into 2 rules:

#1:  All accounts should be disabled after 90 days inactivity

#2:  Temp accounts need to be chage'd to $creationDate+90 days 
(procedurally). We could potentially identify temp accounts by 
suggesting they all be created within a specific UID range, then we can 
just chage on all UIDs within that range to verify temp accounts do not 
exceed 90 days
     - This could be a problem if account is "extended," we'll need to 
think through this...


More information about the scap-security-guide mailing list