Detections
Analytics

2.7 Ensure 'password_lifetime' is Less Than or Equal to '365'

Information

Password expiration provides users with a unique time-bounded password lifetime.

This allows additional security factors pertinent to a specific user to provide further password security; predetermined by varying security needs and usability requirements in a system or organization.

Solution

To configure the global password lifetime to 365, execute the following command:

set persist default_password_lifetime = 365;

Alternatively, configure the password lifetime for each user returned by the audit procedure by executing the following command:

ALTER USER '<username>'@'<localhost>' PASSWORD EXPIRE INTERVAL 365 DAY;

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CSCv7|16.10

Plugin: MySQLDB

Control ID: d9f635eba76ff1a3205c37fbe392e99c8ddd6dbd2583e7e6d4c453b8368c89c4