AOSX-13-002085 - The macOS system must enforce a 60-day maximum password lifetime restriction.

Information

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically.

One method of minimizing this risk is to use complex passwords and periodically change them. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Solution

This setting may be enforced using the 'Passcode Policy' configuration profile or by a directory service.

To set the password policy without a configuration profile, run the following command to save a copy of the current 'pwpolicy' account policy file:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist

Open the generated file in a text editor.

If the file does not yet contain any policy settings, replace <dict/> with <dict></dict>.

If there already is a policy block that refers to password expiration, ensure it is set to '60' days.

If the line '<key>policyCategoryPasswordChange</key>' is not present in the file, add the following text immediately after the opening <dict> tag in the file:

<key>policyCategoryPasswordChange</key>
<array>
<dict>
<key>policyContent</key>
<string>policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)</string>
<key>policyIdentifier</key>
<string>Password Change Interval</string>
<key>policyParameters</key>
<dict>
<key>policyAttributeExpiresEveryNDays</key>
<integer>60</integer>
</dict>
</dict>
</array>

If the line '<key>policyCategoryPasswordChange</key>' is already present in the file, the following text should be added just after the opening <array> tag that follows the line instead:

<dict>
<key>policyContent</key>
<string>policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)</string>
<key>policyIdentifier</key>
<string>Password Change Interval</string>
<key>policyParameters</key>
<dict>
<key>policyAttributeExpiresEveryNDays</key>
<integer>60</integer>
</dict>
</dict>

After saving the file and exiting to the command prompt, run the following command to load the new policy file:

/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist

Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.

Item Details

Audit Name: DISA STIG Apple Mac OSX 10.13 v2r5

Category: IDENTIFICATION AND AUTHENTICATION

Plugin: Unix

Control ID: 9f22afbfe87fed4c8158aacdb99c3f162fa3fc7d8b7d5592385fae5bc2733549

Detections

Analytics

AOSX-13-002085 - The macOS system must enforce a 60-day maximum password lifetime restriction.

Information

Solution

See Also

Item Details