Check: PHTN-67-000036
VMware vSphere 6.7 Photon OS STIG:
PHTN-67-000036
(in versions v1 r6 through v1 r1)
Title
The Photon operating system must disable new accounts immediately upon password expiration. (Cat II impact)
Discussion
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Disabling inactive accounts ensures that accounts that may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Check Content
At the command line, execute the following command: # grep INACTIVE /etc/default/useradd Expected result: INACTIVE=0 If the output does not match the expected result, this is a finding.
Fix Text
Open /etc/default/useradd with a text editor. Remove any existing "INACTIVE" line and add the following line: INACTIVE=0
Additional Identifiers
Rule ID: SV-239108r675132_rule
Vulnerability ID: V-239108
Group Title: SRG-OS-000118-GPOS-00060
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000795 |
The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
IA-4 |
Identifier Management |