The BIG-IP appliance must automatically remove or disable temporary user accounts after 72 hours.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228979	F5BI-DM-000015	SV-228979r879887_rule		Medium

Description
Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the network device since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.

Description

Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts remain active when no longer needed, they may be used to gain unauthorized access. The risk is greater for the network device since these accounts have elevated privileges. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.

STIG	Date
F5 BIG-IP Device Management Security Technical Implementation Guide	2024-01-26

Details

Check Text ( C-31294r517984_chk )
Verify the BIG-IP appliance is configured to use a remote authentication server to automatically disable or remove temporary accounts after 72 hours. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify "Authentication: User Directory" is configured for an approved remote authentication server that automatically removes or disables temporary user accounts after 72 hours. If the use of temporary accounts is prohibited, this is not a finding. If the BIG-IP appliance is not configured to use a remote authentication server that automatically disables or removes temporary accounts after 72 hours, this is a finding.

Check Text ( C-31294r517984_chk )

Verify the BIG-IP appliance is configured to use a remote authentication server to automatically disable or remove temporary accounts after 72 hours.

Navigate to the BIG-IP System manager >> System >> Users >> Authentication.

Verify "Authentication: User Directory" is configured for an approved remote authentication server that automatically removes or disables temporary user accounts after 72 hours.

If the use of temporary accounts is prohibited, this is not a finding.

If the BIG-IP appliance is not configured to use a remote authentication server that automatically disables or removes temporary accounts after 72 hours, this is a finding.

Fix Text (F-31271r517985_fix)
Configure the BIG-IP appliance to use an approved remote authentication server that automatically removes or disables temporary user accounts after 72 hours.