STIGQter STIGQter: STIG Summary: Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Mar 2021:

The Ubuntu operating system must automatically remove or disable emergency accounts after 72 hours.

DISA Rule

SV-238331r654168_rule

Vulnerability Number

V-238331

Group Title

SRG-OS-000123-GPOS-00064

Rule Version

UBTU-20-010410

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

If an emergency account must be created, configure the system to terminate the account after a 72-hour time period with the following command to set an expiration date on it. Substitute "account_name" with the account to be created.

$ sudo chage -E $(date -d "+3 days" +%F) account_name

Check Contents

Verify the Ubuntu operating system expires emergency accounts within 72 hours or less.

For every emergency account, run the following command to obtain its account expiration information:

$ sudo chage -l account_name | grep expires

Password expires : Aug 07, 2019
Account expires : Aug 07, 2019

Verify each of these accounts has an expiration date set within 72 hours of account creation.

If any of these accounts do not expire within 72 hours of that account's creation, this is a finding.

Vulnerability Number

V-238331

Documentable

False

Rule Version

UBTU-20-010410

Severity Override Guidance

Verify the Ubuntu operating system expires emergency accounts within 72 hours or less.

For every emergency account, run the following command to obtain its account expiration information:

$ sudo chage -l account_name | grep expires

Password expires : Aug 07, 2019
Account expires : Aug 07, 2019

Verify each of these accounts has an expiration date set within 72 hours of account creation.

If any of these accounts do not expire within 72 hours of that account's creation, this is a finding.

Check Content Reference

M

Target Key

5318

Comments