BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

supplemental_password_policy Password Policy Supplemental

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded Supplemental

Title

Password Policy Supplemental

Discussion

To comply with Executive Order 14028, “Improving the Nation's Cybersecurity”, OMB M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, and NIST SP-800-63b, “Digital Identity Guidelines: Authentication and Lifecycle Management” federal, military, and intelligence communities must adopt the following configuration settings:

* Password policies must not require the use of complexity policies such as upper characters, lower characters, or special characters.
* Password policies must also not require the use of regular rotation.

In accordance with these requirements, the following rules, while they remain on specific benchmarks, have been removed from any of the NIST 800-53r5 baselines as recommendations.

* pwpolicy_alpha_numeric_enforce
* pwpolicy_custom_regex_enforce
* pwpolicy_lower_case_character_enforce.yaml
* pwpolicy_max_lifetime_enforce
* pwpolicy_minimum_lifetime_enforce
* pwpolicy_prevent_dictionary_words
* pwpolicy_simple_sequence_disable
* pwpolicy_special_character_enforce
* pwpolicy_upper_case_character_enforce.yaml

If an organization has requirements to implement additional password policies, the remainder of this supplemental discusses the following password policy rules:

* pwpolicy_lower_case_character_enforce
* pwpolicy_upper_case_character_enforce
* pwpolicy_account_inactivity_enforce
* pwpolicy_minimum_lifetime_enforce

Password policies should be enforced as much as possible via Configuration Profiles. However, the following policies are currently not enforceable via Configuration Profiles, and must therefore be enabled using the `pwpolicy` command:

* Enforcing at least 1 lowercase character
* Enforcing at least 1 uppercase character
* Disabling an account after 35 days of inactivity
* Password minimum lifetime

To set the local policy to meet these requirements, save the following XML password policy to a file.

[source,xml]
----
include::../../includes/pwpolicy.xml[]
----

Run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".

[source,bash]
----
/usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
----

[NOTE]
====
If directory services is being utilized, password policies should come from the domain.
====

[WARNING]
====
In order to apply any password policy, the `allowPasscodeModification` setting in `com.apple.applicationaccess` must not be set to `false`.
====