The SLES for vRealize must disable account identifiers of individuals and roles (such as root) after 35 days of inactivity after password expiration.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240461	VRAU-SL-000725	SV-240461r671124_rule		Medium

Description
Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Operating systems need to track periods of inactivity and disable application identifiers after 35 days of inactivity.

STIG	Date
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide	2021-06-24

Details

Check Text ( C-43694r671122_chk )
Verify the SLES for vRealize disables account identifiers after "35" days of inactivity after the password expiration, by performing the following commands: # grep "INACTIVE" /etc/default/useradd The output must indicate the "INACTIVE" configuration option is set to an appropriate integer as shown in the example below: grep "INACTIVE" /etc/default/useradd INACTIVE=35 If "INACTIVE" is not set to the value of "35" or less, this is a finding.

Check Text ( C-43694r671122_chk )

Verify the SLES for vRealize disables account identifiers after "35" days of inactivity after the password expiration, by performing the following commands:

# grep "INACTIVE" /etc/default/useradd

The output must indicate the "INACTIVE" configuration option is set to an appropriate integer as shown in the example below:

grep "INACTIVE" /etc/default/useradd
INACTIVE=35

If "INACTIVE" is not set to the value of "35" or less, this is a finding.

Fix Text (F-43653r671123_fix)
Configure the SLES for vRealize to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for useradd: Replace [VALUE] in the command with any integer from the range 0<[VALUE]<= 35. # sed -i "s/^.\bINACTIVE\b.$/INACTIVE=[VALUE]/" /etc/default/useradd DoD recommendation is "35" days, but a lower value is acceptable. The value "-1" will disable this feature and "0" will disable the account immediately after the password expires.

Fix Text (F-43653r671123_fix)

Configure the SLES for vRealize to disable account identifiers after 35 days of inactivity after the password expiration. Run the following command to change the configuration for useradd:

Replace [VALUE] in the command with any integer from the range 0<[VALUE]<= 35.
# sed -i "s/^.*\bINACTIVE\b.*$/INACTIVE=[VALUE]/" /etc/default/useradd

DoD recommendation is "35" days, but a lower value is acceptable. The value "-1" will disable this feature and "0" will disable the account immediately after the password expires.