The DNS implementation must enforce maximum password lifetime restrictions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34114	SRG-NET-000163-DNS-000102	SV-44567r1_rule		Medium

Description
Passwords need to be changed at specific policy based intervals to avoid almost certain compromise. Any password, no matter how complex, can eventually be cracked and, therefore, must be changed frequently. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.

Description

Passwords need to be changed at specific policy based intervals to avoid almost certain compromise. Any password, no matter how complex, can eventually be cracked and, therefore, must be changed frequently. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42074r1_chk )
Review the DNS account management configuration and settings to determine if maximum password lifetime restrictions are configured. If maximum password lifetime restrictions are not configured, this is a finding. The account management functions will be performed by the name server application if the capability exists. If the capability does not exist the underlying platform's account management system may be used.

Check Text ( C-42074r1_chk )

Review the DNS account management configuration and settings to determine if maximum password lifetime restrictions are configured. If maximum password lifetime restrictions are not configured, this is a finding.

The account management functions will be performed by the name server application if the capability exists. If the capability does not exist the underlying platform's account management system may be used.

Fix Text (F-38024r1_fix)
Configure the DNS implementation to enforce maximum password lifetime restrictions.