NixOS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

An XCCDF Rule

Description

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Operating systems need to track periods of inactivity and disable application identifiers after 35 days of inactivity.

ID: SV-268174r1039410_rule
Version: ANIX-00-001930
Severity: Medium
References: CCI-003627
Updated: about 2 months ago

Remediation Templates

Configure the NixOS operating system to disable inactive users.

Add the following Nix code to the NixOS Configuration usually located in /etc/nixos/configuration.nix.

Ensure that utils and lib modules are available
 { config, pkgs, lib, utils, ... }:
 environment.etc."/default/useradd".text = pkgs.lib.mkForce
   ''
    INACTIVE=35
   '';

Rebuild the NixOS configuration with the following command:

$ sudo nixos-rebuild switch

NixOS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Description

Remediation Templates

A Manual Procedure