Assign Expiration Date to Emergency Accounts
An XCCDF Rule
Description
Emergency accounts are privileged accounts established in response to
crisis situations where the need for rapid account activation is required.
In the event emergency accounts are required, configure the system to
terminate them after a documented time period. For every emergency account,
run the following command to set an expiration date on it, substituting
ACCOUNT_NAME and YYYY-MM-DD
appropriately:
$ sudo chage -E YYYY-MM-DD ACCOUNT_NAME
YYYY-MM-DD indicates the documented expiration date for the
account. For U.S. Government systems, the operating system must be
configured to automatically terminate these types of accounts after a
period of 72 hours.
warning alert: Warning
Due to the unique requirements of each system, automated
remediation is not available for this configuration check.
warning alert: Warning
This rule is deprecated in favor of the
account_temp_expire_date rule.Please consider replacing this rule in your files as it is not expected to receive
updates as of version 0.1.69.Rationale
If emergency user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all emergency accounts
must be set upon account creation.
- ID
- xccdf_org.ssgproject.content_rule_account_emergency_expire_date
- Severity
- Medium
- References
- Updated