UCF STIG Viewer Logo

A maximum password age must be set.


Overview

Finding ID Version Rule ID IA Controls Severity
V-25204 OSX00020 M6 SV-37158r1_rule IAIA-1 IAIA-2 Medium
Description
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.
STIG Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide 2013-04-09

Details

Check Text ( C-35870r1_chk )
Open a terminal session and use the following command to view the setting for maximum password age.
sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword.
If the value of "maxMinutesUntilChangePassword" is greater than 86400 or set to "0", this is a finding.

NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems.
pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword
If the value of "maxMinutesUntilChangePassword" is greater than 86400, this is a finding.

NOTE: The value of "0" will disable this setting and must not be used.
Fix Text (F-34540r1_fix)
Open a terminal session and use the following command to set the value for maxMinutesUntilChangePassword.

sudo pwpolicy -n -setglobalpolicy "maxMinutesUntilChangePassword=86400"

NOTE: For non-managed system, use the following command.

pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=86400"