Seeking Input: CCI-001459 Remediation - Temp Account Termination

Kurt Seifried kseifried at redhat.com
Wed Apr 25 19:27:26 UTC 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/25/2012 01:22 PM, Shawn Wells wrote:
> On 4/25/12 3:18 PM, Shawn Wells wrote:
>> Hey Guys,
>> 
>> CCI-001459 requires that temp accounts be terminated after a 
>> organizationally defined period of time. Right now we don't have
>> a check/control that implements that.
>> 
>> I'd like to add prose that recommends that -ALL- accounts be 
>> locked after 60 (or  90... or 120..) days of inactivity. This
>> would allow us to automatically meet CCI-001459 and enforces that
>> inactive accounts should (eventually and automatically) be
>> frozen.
>> 
>> Thoughts? My thinking is that 90 days of inactivity is a good
>> number.
> 
> Sitting in a room with Willy Santos, and he just brought up a good 
> point. This really should be broken into 2 rules:
> 
> #1:  All accounts should be disabled after 90 days inactivity

How do you measure activity? login? checked email? logged in via ftp?
Not all accounts are used to login. Also what happens if you use
central admin like ldap/etc.

> #2:  Temp accounts need to be chage'd to $creationDate+90 days 
> (procedurally). We could potentially identify temp accounts by 
> suggesting they all be created within a specific UID range, then we
> can just chage on all UIDs within that range to verify temp
> accounts do not exceed 90 days - This could be a problem if account
> is "extended," we'll need to think through this...

Shouldn't they have created the temp account with an expiry date?

adduser
- -e, --expiredate EXPIRE_DATE
           The date on which the user account will be disabled. The
date is specified in the format YYYY-MM-DD.

or use usermod with the same option to auto expire the account at date X?

> _______________________________________________ scap-security-guide
> mailing list scap-security-guide at lists.fedorahosted.org 
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPmFAeAAoJEBYNRVNeJnmT5N8P/jbibn5/2BH/v2gxb61/vJZ6
y4YtyNuGsfRJyGhv3KyG6gM0rX9dkZ5/aM+C3hBeSnpV4EXiHAFmB2Ud27639rkh
bDo0EMXtcLT816LtQcMGtHmzKWNCUNhevPec5knMa5MlSbQ0GL6EiKr7oA02P78/
TbZm8Dkp+OQQ0Wei8HCIAHlv0yUqyf/oqS6iscBfCQrhtdsdaTduca8dbBav/A89
gpdJ/H/sngnlkIyj5QRmav1ZRSbTrb3CJguc8UlvjSds3Tg/wzvE3SzAcrhr+LV+
8oodJ6ui70giir6YVzVNgM98en+34sIjAT5K1gT0v1mSKEFUEll7+VhHlKEceKNO
pc/DShneYoxd/EajXDU/B4LXuZzJfP/qkA2p+oqZojT0QbtA5Btu9DKqTyLtLUac
szTPDycly43uR30uybg/07gRzNE13Gwu4dZbI1T7h/tEVb8xHlvZZ+ezc/W525r2
Dq9f//rEFoOLJJoZif7gNXkYpl+F0MfnQ1jH4f4Ek1j+vBFw5jvMY44Tg0+uw72J
mNVnM1SPjuIgdcUjGxVrYHoGMwv8wrSubPKScez5hd7ma4r8vRvcjlpD6HeNJm3g
cNCGcv5xiQmSkIUvW3BPD7oQzL+/oLTMJPTFgkolGjOQ6zUDcNHWAGvqZG1wmHoc
qwSmTg84PXq3pz4qgA2c
=Qpwk
-----END PGP SIGNATURE-----


More information about the scap-security-guide mailing list