The macOS system must enforce a 60-day maximum password lifetime restriction.

From Apple OS X 10.13 Security Technical Implementation Guide

Part of SRG-OS-000076-GPOS-00044

Associated with: CCI-000199

SV-96449r1_rule The macOS system must enforce a 60-day maximum password lifetime restriction.

Vulnerability discussion

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically.One method of minimizing this risk is to use complex passwords and periodically change them. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Check content

Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require users to change their passwords every 60 days: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep maxPINAgeInDays If the return is null, or is not “maxPINAgeInDays = 60” or set to a smaller value, this is a finding. If password policy is set with the "pwpolicy" utility, run the following command instead: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies Look for the line policyCategoryPasswordChange. If it does not exist, and password policy is not controlled by a directory service, this is a finding. Otherwise, in the array section that follows it, there should be a section that contains a check that compares the variable "policyAttributeLastPasswordChangeTime" to the variable "policyAttributeCurrentTime". It may contain additional variables defined in the "policyParameters" section that follows it. All comparisons are done in seconds. If this check allows users to log in with passwords older than "60" days, or if no such check exists, this is a finding.

Fix text

This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service. To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist Open the generated file in a text editor. If the file does not yet contain any policy settings, replace with . If there already is a policy block that refers to password expiration, ensure it is set to "60" days. If the line "policyCategoryPasswordChange" is not present in the file, add the following text immediately after the opening tag in the file: policyCategoryPasswordChange policyContent policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60) policyIdentifier Password Change Interval policyParameters policyAttributeExpiresEveryNDays 60 If the line "policyCategoryPasswordChange" is already present in the file, the following text should be added just after the opening tag that follows the line instead: policyContent policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60) policyIdentifier Password Change Interval policyParameters policyAttributeExpiresEveryNDays 60 After saving the file and exiting to the command prompt, run the following command to load the new policy file: /usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.

Pro Tips

Powered by sagemincer