GEN000740 - All non-interactive/automated processing account passwords must be changed at least once per year or be locked.

Information

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Locking the password for non-interactive and automated processing accounts is preferred as it removes the possibility of accessing the account by a password. On some systems, locking the passwords of these accounts may prevent the account from functioning properly. Passwords for non-interactive/automated processing accounts must not be used for direct logon to the system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Implement or establish procedures to change the passwords of automated processing accounts at least once per year.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_10_x86_V2R2_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(d), CAT|II, CCI|CCI-000199, Rule-ID|SV-227592r603266_rule, STIG-ID|GEN000740, STIG-Legacy|SV-12478, STIG-Legacy|V-11977, Vuln-ID|V-227592

Plugin: Unix

Control ID: 6003859e6b2c665782eb8b87f8e78a2d4fab050bef0262e0e482e8b8223bb216