[PATCH] added new Rule and check to disable inactive accounts * inactivity is defined as time following automatic password expiration * also added relevant CCI refs

Shawn Wells shawn at redhat.com
Wed Jun 27 22:45:53 UTC 2012


On 6/27/12 6:35 PM, Jeffrey Blank wrote:
> +<Rule id="account_disable_post_pw_expiration">
> +<title>Set Account Expiration Following Inactivity</title>
> +<description>To specify the number of days after a password expires
> +(which signifies inactivity) until an
> +account is permanently disabled, edit the file <tt>/etc/defaults/useradd</tt>
> +and add or correct the following lines, substituting <tt><i>NUM_DAYS</i></tt> appropriately:
> +<pre>INACTIVE=<i>NUM_DAYS</i></pre>
> +A value of 35 is recommended.  If a password is currently on the
> +verge of expiration, then 35 days remain until the account is automatically
> +disabled. However, if the password will not expire for another 60 days, then 95
> +days could elapse until the account would be automatically disabled. See the
> +<tt>useradd</tt> man page for more information.  Determining the inactivity
> +timeout must be done with careful consideration of the length of a "normal"
> +period of inactivity for users in the particular environment. Setting
> +the timeout too low incurs support costs and also has the potential to impact
> +availability of the system to legitimate users.
> +</description>
> +<rationale>

nitpick. kinda.

do we want to have them edit text files, or just issue a chage command ala
# chage -I 35 shawn

              ^ that's an uppercase i

and the idea of using this concept as the definition of 'inactive 
account' is novel, I haven't thought of this before!


More information about the scap-security-guide mailing list