pwpolicy_account_inactivity_enforce Disable Accounts after $ODV Days of Inactivity
All changes in this version
Title
Disable Accounts after $ODV Days of Inactivity
Control
/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' -
Discussion
The macOS _MUST_ be configured to disable accounts after $ODV days of inactivity.
This rule prevents malicious users from making use of unused accounts to gain access to the system while avoiding detection.
Related controls
ac-2.3
Fix
This setting may be enforced using local policy or by a directory service.
To set local policy to disable an inactive user after $ODV days, edit the current password policy to contain the following <dict> within the "policyCategoryAuthentication":
[source,xml]
----
<dict>
<key>policyContent</key>
<string>policyAttributeLastAuthenticationTime > policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60)</string>
<key>policyIdentifier</key>
<string>Inactive Account</string>
<key>policyParameters</key>
<dict>
<key>policyAttributeInactiveDays</key>
<integer>$ODV</integer>
</dict>
</dict>
----
After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".
[source,bash]
----
/usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
----
NOTE: See the password policy supplemental on more information on how to implement password policies on macOS.