User passwords must be changed at least every 56 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-216321	SOL-11.1-040010	SV-216321r505927_rule		Medium

Description
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2020-09-04

Details

Check Text ( C-17557r371051_chk )
The root role is required. Determine if user passwords are properly configured to be changed every 56 days. # logins -ox \|awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }' If output is returned and the listed account is accessed via direct logon, this is a finding. Check that /etc/default/password is configured to enforce password expiration every 56 days or less. # grep "^MAXWEEKS=" /etc/default/passwd If the command does not report MAXWEEKS=8 or less, this is a finding.

Check Text ( C-17557r371051_chk )

The root role is required.

Determine if user passwords are properly configured to be changed every 56 days.

# logins -ox |awk -F: '( $1 != "root" && $8 != "LK" && $8 != "NL" && $11 != "56" ) { print }'

If output is returned and the listed account is accessed via direct logon, this is a finding.

Check that /etc/default/password is configured to enforce password expiration every 56 days or less.

# grep "^MAXWEEKS=" /etc/default/passwd

If the command does not report MAXWEEKS=8 or less, this is a finding.

Fix Text (F-17555r371052_fix)
The User Security role is required. Change each username to enforce 56 day password changes. # pfexec passwd -x 56 [username] # pfedit /etc/default/passwd Search for MAXWEEKS. Change the line to read: MAXWEEKS=8