BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APPL-26-003080 The macOS system must disable accounts after 35 days of inactivity.

DISA STIG library V1R4
All changes in this version
first version loaded CAT II

Maps to AC-2(3) via CCI-003627, CCI-003628

Title

The macOS system must disable accounts after 35 days of inactivity.

Control

Verify the macOS system is configured to disable accounts after 35 days of inactivity with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - If the result is not "35", this is a finding.

Discussion

The macOS must be configured to disable accounts after 35 days of inactivity. This rule prevents malicious users from employing unused accounts to gain access to the system while avoiding detection. Satisfies: SRG-OS-000118-GPOS-00060, SRG-OS-000590-GPOS-00110

Related controls

CCI-003627, CCI-003628

Fix

Configure the macOS system to disable accounts after 35 days of inactivity with the following command: This setting may be enforced using local policy. To set local policy to disable an inactive user after 35 days, edit the current password policy to contain the following within the "policyCategoryAuthentication": [source,xml] ---- policyContent policyAttributeLastAuthenticationTime > policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60) policyIdentifier Inactive Account policyParameters policyAttributeInactiveDays 35 ---- After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file". [source,bash] ---- /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file ----