Title

Accounts must be locked upon 35 days of inactivity. (Cat II impact)

Discussion

Inactive user accounts pose a risk to systems and applications. Owners of Inactive accounts will not notice if unauthorized access to their account has been obtained. There is a risk that inactive accounts can potentially be exploited to obtain and maintain undetected access to a system and/or application. The operating system must track periods of user account inactivity and disable all inactive accounts. Non-interactive accounts on the system, such as application accounts, may be documented exceptions. Non-interactive accounts on the system, such as application accounts, may be documented exceptions. Non-interactive accounts on the system, such as application accounts, may be documented exceptions.

Check Content

For Trusted Mode: Verify that user accounts are locked after 35 days of inactivity. Note: The “u_llogin” attribute is stored in seconds: 86400 seconds/day * 35 days = 3024000 seconds. # cd /tcb/files/auth && cat */* | egrep “:u_name=|:u_llogin=“ If user account is not set to lock after 35 days of inactivity, this is a finding. For SMSE: Check the INACTIVITY_MAXDAYS setting. # grep INACTIVITY_MAXDAYS /etc/default/security /var/adm/userdb/* If INACTIVITY_MAXDAYS is set to 0 or greater than 35 for any user, this is a finding.

Fix Text

For Trusted Mode: Use the SAM/SMH interface to update the “u_llogin” (user last login) /tcb database attribute. See the /tcb database entry example below: :u_llogin#3024000: For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the INACTIVITY_MAXDAYS attribute. See the below example: INACTIVITY_MAXDAYS=35 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Additional Identifiers

Rule ID: SV-38500r2_rule

Vulnerability ID: V-918

Group Title: GEN000760

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.