A maximum password age must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25204	OSX00020 M6	SV-37158r1_rule	IAIA-1 IAIA-2	Medium

Description
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft	2013-01-10

Details

Check Text ( C-35870r1_chk )
Open a terminal session and use the following command to view the setting for maximum password age. sudo pwpolicy -n -getglobalpolicy \| tr " " "\n" \| grep maxMinutesUntilChangePassword. If the value of "maxMinutesUntilChangePassword" is greater than 86400 or set to "0", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy \| tr " " "\n" \| grep maxMinutesUntilChangePassword If the value of "maxMinutesUntilChangePassword" is greater than 86400, this is a finding. NOTE: The value of "0" will disable this setting and must not be used.

Check Text ( C-35870r1_chk )

Open a terminal session and use the following command to view the setting for maximum password age.
sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword.
If the value of "maxMinutesUntilChangePassword" is greater than 86400 or set to "0", this is a finding.

NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems.
pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword
If the value of "maxMinutesUntilChangePassword" is greater than 86400, this is a finding.

NOTE: The value of "0" will disable this setting and must not be used.

Fix Text (F-34540r1_fix)
Open a terminal session and use the following command to set the value for maxMinutesUntilChangePassword. sudo pwpolicy -n -setglobalpolicy "maxMinutesUntilChangePassword=86400" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=86400"