The macOS system must enforce a 60-day maximum password lifetime restriction.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214927	AOSX-13-002085	SV-214927r507075_rule		Medium

Description
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. One method of minimizing this risk is to use complex passwords and periodically change them. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

STIG	Date
Apple OS X 10.13 Security Technical Implementation Guide	2020-09-11

Details

Check Text ( C-16127r397353_chk )
Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require users to change their passwords every 60 days: /usr/sbin/system_profiler SPConfigurationProfileDataType \| /usr/bin/grep maxPINAgeInDays If the return is null, or is not “maxPINAgeInDays = 60” or set to a smaller value, this is a finding. If password policy is set with the "pwpolicy" utility, run the following command instead: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies Look for the line policyCategoryPasswordChange. If it does not exist, and password policy is not controlled by a directory service, this is a finding. Otherwise, in the array section that follows it, there should be a section that contains a check that compares the variable "policyAttributeLastPasswordChangeTime" to the variable "policyAttributeCurrentTime". It may contain additional variables defined in the "policyParameters" section that follows it. All comparisons are done in seconds. If this check allows users to log in with passwords older than "60" days, or if no such check exists, this is a finding.

Check Text ( C-16127r397353_chk )

Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require users to change their passwords every 60 days:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxPINAgeInDays
If the return is null, or is not “maxPINAgeInDays = 60” or set to a smaller value, this is a finding.

If password policy is set with the "pwpolicy" utility, run the following command instead:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies

Look for the line policyCategoryPasswordChange.

If it does not exist, and password policy is not controlled by a directory service, this is a finding.

Otherwise, in the array section that follows it, there should be a section that contains a check that compares the variable "policyAttributeLastPasswordChangeTime" to the variable "policyAttributeCurrentTime". It may contain additional variables defined in the "policyParameters" section that follows it. All comparisons are done in seconds.

If this check allows users to log in with passwords older than "60" days, or if no such check exists, this is a finding.

Fix Text (F-16125r397354_fix)
This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service. To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies \| tail -n +2 > pwpolicy.plist Open the generated file in a text editor. If the file does not yet contain any policy settings, replace with . If there already is a policy block that refers to password expiration, ensure it is set to "60" days. If the line "policyCategoryPasswordChange" is not present in the file, add the following text immediately after the opening tag in the file: policyCategoryPasswordChange policyContent policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60) policyIdentifier Password Change Interval policyParameters policyAttributeExpiresEveryNDays 60 If the line "policyCategoryPasswordChange" is already present in the file, the following text should be added just after the opening tag that follows the line instead: policyContent policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60) policyIdentifier Password Change Interval policyParameters policyAttributeExpiresEveryNDays 60 After saving the file and exiting to the command prompt, run the following command to load the new policy file: /usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.

Fix Text (F-16125r397354_fix)

This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service.

To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist

Open the generated file in a text editor.

If the file does not yet contain any policy settings, replace with .

If there already is a policy block that refers to password expiration, ensure it is set to "60" days.

If the line "policyCategoryPasswordChange" is not present in the file, add the following text immediately after the opening tag in the file:

policyCategoryPasswordChange

policyContent
policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)
policyIdentifier
Password Change Interval
policyParameters

policyAttributeExpiresEveryNDays
60

If the line "policyCategoryPasswordChange" is already present in the file, the following text should be added just after the opening tag that follows the line instead:

policyContent
policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)
policyIdentifier
Password Change Interval
policyParameters

policyAttributeExpiresEveryNDays
60

After saving the file and exiting to the command prompt, run the following command to load the new policy file:

/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist

Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.