V-216321

Discussion

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Solaris 11.4 introduced new password security features that allow for a more granular approach to password duration parameters. The introduction of "MAXDAYS", "MINDAYS", and "WARNDAYS" allow the "/etc/default/passwd" configuration file to enforce a password change every 180 days.

Check Content

The root role is required.

Determine if user passwords are properly configured to be changed every 180 days.

Determine the OS version to be secured.
# uname -v

For Solaris 11, 11.1, 11.2, and 11.3:

# logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && ( $11 > "175" || $11 < "1" )) { print }'

If output is returned and the listed account is accessed via direct logon, this is a finding.

Check that "/etc/default/password" is configured to enforce password expiration every 25 weeks or less.

# grep "^MAXWEEKS=" /etc/default/passwd 

If the command does not report "MAXWEEKS=25" or less, this is a finding.

For Solaris 11.4 or newer:

# logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && ($11 > "180"|| $11 < "1")) { print }'

If output is returned and the listed account is accessed via direct logon, this is a finding.

Check that "/etc/default/password" is configured to enforce password expiration every 180 days or less.
Note: It is an error to set both the WEEKS and the DAYS variant for a given MIN/MAX/WARN variable.

# grep "^MAXDAYS=" /etc/default/passwd 

If the command does not report "MAXDAYS=180" or less, this is a finding.

# grep "^MAXWEEKS=" /etc/default/passwd 

If output is returned, this is a finding.