User passwords must be changed at least every 56 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-47943	SOL-11.1-040010	SV-60815r1_rule		Medium

Description
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2015-06-26

Details

Check Text ( C-50379r2_chk )
The root role is required. Determine if user passwords are properly configured to be changed every 56 days. # logins -ox \|awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }' If output is returned, this is a finding. Check that /etc/default/password is configured to enforce password expiration every 56 days or less. # grep "^MAXWEEKS=" /etc/default/passwd If the command does not report MAXWEEKS=8 or less, this is a finding.

Check Text ( C-50379r2_chk )

The root role is required.

Determine if user passwords are properly configured to be changed every 56 days.

# logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }'

If output is returned, this is a finding.

Check that /etc/default/password is configured to enforce password expiration every 56 days or less.

# grep "^MAXWEEKS=" /etc/default/passwd

If the command does not report MAXWEEKS=8 or less, this is a finding.

Fix Text (F-51555r1_fix)
The User Security role is required. Change each username to enforce 56 day password changes. # pfexec passwd -x 56 [username] # pfedit /etc/default/passwd Search for MAXWEEKS. Change the line to read: MAXWEEKS=8