PHTN-67-000036 - The Photon operating system must disable new accounts immediately upon password expiration.

Information

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.

Disabling inactive accounts ensures that accounts that may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Solution

Open /etc/default/useradd with a text editor.

Remove any existing 'INACTIVE' line and add the following line:

INACTIVE=0

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-4e., CAT|II, CCI|CCI-000795, Rule-ID|SV-239108r675132_rule, STIG-ID|PHTN-67-000036, Vuln-ID|V-239108

Plugin: Unix

Control ID: 87953ce200a2abe4e9eb308200057b50db633bdba597304b82846c07dbb0e3fd