Detections
Analytics

ALMA-09-004750 - AlmaLinux OS 9 must automatically expire temporary accounts within 72 hours.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Temporary accounts are accounts created during a time of need when prompt action requires bypassing the normal account creation authorization process - such as during incident response.

If these temporary accounts are left enabled (and may have elevated permissions via sudo, group membership or SSH keys) and are not automatically expired or manually removed, the security posture of the system will be degraded and left vulnerable to insider threat.

Temporary accounts are not the same as "last resort" or "break glass" emergency accounts which are local system accounts to be used by and maintained by authorized system administrators when standard remote access/authentication is unavailable. Emergency accounts are not subject to removal or expiration requirements.

Satisfies: SRG-OS-000002-GPOS-00002, SRG-OS-000123-GPOS-00064

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure automatic account expiration after 72 hours by running the following command for each temporary account:

$ chage -E $(date -d +3days +%Y-%m-%d) <account_name>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R5_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000016, CCI|CCI-001682, Rule-ID|SV-269128r1050010_rule, STIG-ID|ALMA-09-004750, Vuln-ID|V-269128

Plugin: Unix

Control ID: 7e7425a0f534cbfc1ce628c4706743b96f573741ee3fde551552e66f3d1926e9