Check: GEN000740
HP-UX 11.31 STIG:
GEN000740
(in versions v1 r19 through v1 r13)
Title
All non-interactive/automated processing account passwords must be changed at least once per year or be locked. (Cat II impact)
Discussion
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Locking the password for non-interactive and automated processing accounts is preferred as it removes the possibility of accessing the account by a password. On some systems, locking the passwords of these accounts may prevent the account from functioning properly. Passwords for non-interactive/automated processing accounts must not be used for direct logon to the system.
Check Content
NOTE: This will always require a manual review. This is a local policy issue/question. Ask the Systems Administrator (SA) if there are any automated processing accounts on the system. If there are, ask the SA if the passwords for those automated accounts are changed at least once a year. If SA indicates passwords for automated processing accounts are not changed once per year, this is a finding
Fix Text
Implement or establish procedures to change the passwords of automated processing accounts at least once per year.
Additional Identifiers
Rule ID: SV-38211r1_rule
Vulnerability ID: V-11977
Group Title: GEN000740
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000199 |
The information system enforces maximum password lifetime restrictions. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |