SOL-11.1-040280 - User accounts must be locked after 35 days of inactivity.

Information

Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Operating systems need to track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise.

This policy does not apply to either emergency accounts or infrequently used accounts. Infrequently used accounts are local logon accounts used by system administrators when network or normal logon/access is not available. Emergency accounts are administrator accounts created in response to crisis situations.

Satisfies: SRG-OS-000003, SRG-OS-000118

Solution

The root role is required.

Perform the following to implement the recommended state:

# useradd -D -f 35

To set this policy on a user account, use the command(s):

# usermod -f 35 [username]

To set this policy on a role account, use the command(s):

# rolemod -f 35 [name]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_SPARC_V3R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CAT|II, CCI|CCI-000017, CCI|CCI-003627, CCI|CCI-003628, Rule-ID|SV-216344r986408_rule, STIG-ID|SOL-11.1-040280, STIG-Legacy|SV-60951, STIG-Legacy|V-48079, Vuln-ID|V-216344

Plugin: Unix

Control ID: 13e05498bc67fa801f82b2e8f827c2688d559804d31301c5923afcc0df63e140