The AAA Service must be configured to prevent automatically disabling emergency accounts.

From Authentication Authorization and Accounting Service Security Requirements Guide

Part of SRG-APP-000234-AAA-000007

Associated with: CCI-001682

SRG-APP-000234-AAA-000007_rule The AAA Service must be configured to prevent automatically disabling emergency accounts.

Vulnerability discussion

Emergency accounts are administrator accounts which are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.Emergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account which is created for use by vendors or system maintainers, that is removed once the crisis has passed. When the AAA Service does not perform account management, then the connected Active Directory must provide this setting.

Check content

If the AAA Service relies on directory services for user account management this is not applicable and the connected directory services must perform this function. Verify the AAA Service is configured to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set. If the AAA Service is configured to automatically disable emergency accounts, this is a finding.

Fix text

Configure the AAA Service to not automatically disable emergency accounts. Emergency accounts must not have a maximum lifetime set.

Pro Tips

Powered by sagemincer