Seeking Input: CCI-001459 Remediation - Temp Account Termination
Shawn Wells
shawn at redhat.com
Wed Apr 25 19:22:24 UTC 2012
On 4/25/12 3:18 PM, Shawn Wells wrote:
> Hey Guys,
>
> CCI-001459 requires that temp accounts be terminated after a
> organizationally defined period of time. Right now we don't have a
> check/control that implements that.
>
> I'd like to add prose that recommends that -ALL- accounts be
> locked after 60 (or 90... or 120..) days of inactivity. This would
> allow us to automatically meet CCI-001459 and enforces that inactive
> accounts should (eventually and automatically) be frozen.
>
> Thoughts? My thinking is that 90 days of inactivity is a good number.
Sitting in a room with Willy Santos, and he just brought up a good
point. This really should be broken into 2 rules:
#1: All accounts should be disabled after 90 days inactivity
#2: Temp accounts need to be chage'd to $creationDate+90 days
(procedurally). We could potentially identify temp accounts by
suggesting they all be created within a specific UID range, then we can
just chage on all UIDs within that range to verify temp accounts do not
exceed 90 days
- This could be a problem if account is "extended," we'll need to
think through this...
More information about the scap-security-guide
mailing list