Saltstack Official Linux Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

cis-5-4-1-1.yml 1.5KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152
  1. # CIS 5.4.1.1 Ensure password expiration is 90 days or less (Scored)
  2. #
  3. # Description
  4. # ===========
  5. # The PASS_MAX_DAYS parameter in /etc/login.defs allows an administrator to
  6. # force passwords to expire once they reach a defined age. It is recommended
  7. # that the PASS_MAX_DAYS parameter be set to less than or equal to 90 days.
  8. #
  9. # Rationale
  10. # =========
  11. # The window of opportunity for an attacker to leverage compromised credentials
  12. # or successfully compromise credentials via an online brute force attack is
  13. # limited by the age of the password. Therefore, reducing the maximum age of a
  14. # password also reduces an attacker's window of opportunity.
  15. #
  16. # Audit
  17. # =====
  18. # Run the following command and verify PASS_MAX_DAYS is 90 or less:
  19. #
  20. # # grep PASS_MAX_DAYS /etc/login.defs
  21. # PASS_MAX_DAYS 90
  22. #
  23. # Verify all users with a password have their maximum days between password
  24. # change set to 90 or less:
  25. #
  26. # # egrep ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1
  27. # <list of users>
  28. # # chage --list <user>
  29. # Maximum number of days between password change: 90
  30. #
  31. # Remediation
  32. # ===========
  33. # Set the PASS_MAX_DAYS parameter to 90 in /etc/login.defs :
  34. #
  35. # PASS_MAX_DAYS 90
  36. #
  37. # Modify user parameters for all users with a password set to match:
  38. #
  39. # # chage --maxdays 90 <user>
  40. #
  41. # Notes
  42. # =====
  43. # You can also check this setting in /etc/shadow directly. The 5th field
  44. # should be 90 or less for all users with a password.
  45. #
  46. parameters:
  47. linux:
  48. system:
  49. login_defs:
  50. PASS_MAX_DAYS:
  51. value: 90