[PATCH] added new Rule and check to disable inactive accounts * inactivity is defined as time following automatic password expiration * also added relevant CCI refs

Willy Santos wsantos at redhat.com
Fri Jun 29 18:18:20 UTC 2012


EDIT: I made the changes you requested on my local copy, I'll submit 
along with other patches this afternoon.

Willy Santos, RHCE
Consultant
Red Hat Consulting
Cell: +1 (301) 254-7077
Email: wsantos at redhat.com

On 06/29/2012 02:16 PM, Willy Santos wrote:
> Jeff,
>
> Successfully pulled and merged the new content. I made the changes you 
> requested.
>
> -Willy
>
> Willy Santos, RHCE
> Consultant
> Red Hat Consulting
> Cell: +1 (301) 254-7077
> Email: wsantos at redhat.com
>
> On 06/29/2012 02:07 PM, Jeffrey Blank wrote:
>> I just pushed with modification.
>>
>> Willy may want to update mappings to some combination of CCIs 15, 16,
>> and 17 for some combinations of this new Group (account_expiration) and
>> Rule (account_disable_post_pw_expiration).
>>
>> (And perhaps remove the "new rule needed" ref to CCI 17, and correct the
>> closing-tag comments for the Groups in srg_support.xml).
>>
>> I figure it's easier to ask than to cross commits mid-stream...
>>
>> Thanks!
>>
>> On 06/28/2012 12:27 PM, Shawn Wells wrote:
>>> Ack
>>>
>>> -- 
>>> Shawn Wells
>>> Technical Director,
>>> U.S. Intelligence Programs
>>> (e) shawn at redhat.com
>>> (c) 443-534-0130
>>>
>>> On Jun 28, 2012, at 9:38 AM, Jeffrey Blank <blank at eclipse.ncsc.mil> 
>>> wrote:
>>>
>>>> We want to have them edit this text file since we want the setting to
>>>> apply to ALL accounts by default when they are created.
>>>>
>>>> Running chage on one account just sets it for that one account at 
>>>> that time.
>>>>
>>>> That said, I can amend my commit prior to push to mention the 
>>>> existence
>>>> of chage in the enclosing <Group>, so that the information is there.
>>>>
>>>> Sound good?
>>>>
>>>>
>>>>
>>>> On 06/27/2012 06:45 PM, Shawn Wells wrote:
>>>>> On 6/27/12 6:35 PM, Jeffrey Blank wrote:
>>>>>> +<Rule id="account_disable_post_pw_expiration">
>>>>>> +<title>Set Account Expiration Following Inactivity</title>
>>>>>> +<description>To specify the number of days after a password expires
>>>>>> +(which signifies inactivity) until an
>>>>>> +account is permanently disabled, edit the file
>>>>>> <tt>/etc/defaults/useradd</tt>
>>>>>> +and add or correct the following lines, substituting
>>>>>> <tt><i>NUM_DAYS</i></tt> appropriately:
>>>>>> +<pre>INACTIVE=<i>NUM_DAYS</i></pre>
>>>>>> +A value of 35 is recommended.  If a password is currently on the
>>>>>> +verge of expiration, then 35 days remain until the account is
>>>>>> automatically
>>>>>> +disabled. However, if the password will not expire for another 60
>>>>>> days, then 95
>>>>>> +days could elapse until the account would be automatically 
>>>>>> disabled.
>>>>>> See the
>>>>>> +<tt>useradd</tt> man page for more information.  Determining the
>>>>>> inactivity
>>>>>> +timeout must be done with careful consideration of the length of a
>>>>>> "normal"
>>>>>> +period of inactivity for users in the particular environment. 
>>>>>> Setting
>>>>>> +the timeout too low incurs support costs and also has the potential
>>>>>> to impact
>>>>>> +availability of the system to legitimate users.
>>>>>> +</description>
>>>>>> +<rationale>
>>>>> nitpick. kinda.
>>>>>
>>>>> do we want to have them edit text files, or just issue a chage 
>>>>> command ala
>>>>> # chage -I 35 shawn
>>>>>
>>>>>              ^ that's an uppercase i
>>>>>
>>>>> and the idea of using this concept as the definition of 'inactive
>>>>> account' is novel, I haven't thought of this before!
>>>>> _______________________________________________
>>>>> scap-security-guide mailing list
>>>>> scap-security-guide at lists.fedorahosted.org
>>>>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>>>> _______________________________________________
>>>> scap-security-guide mailing list
>>>> scap-security-guide at lists.fedorahosted.org
>>>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide




More information about the scap-security-guide mailing list