Title

A maximum password age must be set. (Cat II impact)

Discussion

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.

Check Content

Open a terminal session and use the following command to view the setting for maximum password age. sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword. If the value of "maxMinutesUntilChangePassword" is greater than 86400 or set to "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword If the value of "maxMinutesUntilChangePassword" is greater than 86400, this is a finding. NOTE: The value of "0" will disable this setting and must not be used.

Fix Text

Open a terminal session and use the following command to set the value for maxMinutesUntilChangePassword. sudo pwpolicy -n -setglobalpolicy "maxMinutesUntilChangePassword=86400" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=86400"

Additional Identifiers

Rule ID: SV-37158r1_rule

Vulnerability ID: V-25204

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.