Join Corey Nachreiner, CTO, and Marc Laliberte, Information Security Threat Analyst, on July 26th as they explore their key findings from the first quarter of 2017.
Course Of The Month
7 days, 21 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
AIX minage & maxage & rlogin in default & indiv ids
Posted on 2016-09-27
In /etc/security/user, we have
default:
admin = false
login = true
su = false
daemon = true
rlogin = true
. . .
minage = 1
maxage = 8
mindiff = 3
maxrepeats = 2
dictionlist =
pwdchecks =
oracle:
minage = 0
maxage = 0
infrauser1:
minage = 0
maxage = 0
sshuser:
admin = false
maxage = 0
infrauser2:
minage = 0
maxage = 0
Q1:
For infrauser1 & 2, shouldn't the minage=1 & maxage=8 to match with the default & security best practice?
Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
Q3:
For oracle account, what's the best/secure practice out there? min & maxage=0 ?
Q4:
for sshuser used to do sftp, what's the best/secure practice out there? min & maxage=0 ?
default:
admin = false
login = true
su = false
daemon = true
rlogin = true
. . .
minage = 1
maxage = 8
mindiff = 3
maxrepeats = 2
dictionlist =
pwdchecks =
oracle:
minage = 0
maxage = 0
infrauser1:
minage = 0
maxage = 0
sshuser:
admin = false
maxage = 0
infrauser2:
minage = 0
maxage = 0
Q1:
For infrauser1 & 2, shouldn't the minage=1 & maxage=8 to match with the default & security best practice?
Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
Q3:
For oracle account, what's the best/secure practice out there? min & maxage=0 ?
Q4:
for sshuser used to do sftp, what's the best/secure practice out there? min & maxage=0 ?
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
4-
2
6 Comments
Active 6 days ago
Q1: Yes, it should match your security policy (I assume the defaults reflect that policy)
Q2: Yes, it should match your security policy
Q3: It should match your security policy
Q4: It should match your security policy
I know this is a simplistic view, but it's best security practice. If it's merely inconvenient for the DBAs to change the oracle password, that's not a good enough reason - You can do a great deal of damage with the oracle ID, so it has to be properly managed. Even better, make the DBAs log in with individual IDs and give those IDs sudo rights to switch to the oracle id.
If the other accounts are configured in multiple endpoints, e.g. scripts, that can make it harder to manage. But you need to know the procedure to change those passwords (including updating any login scripts). Then you can start to enforce regular rotation at a convenient time of day BEFORE the password actually expires.
Also consider using ssh keys instead of passwords, to you can keep better control of access without having to distribute passwords.
Of course, it also depends on how sensitive these accounts are. If the sftp user can't do much apart from get/put non-sensitive files, you can grant an exception in that case - e.g. change the password less often (but still keep track of who/where it is used)
Q2: Yes, it should match your security policy
Q3: It should match your security policy
Q4: It should match your security policy
I know this is a simplistic view, but it's best security practice. If it's merely inconvenient for the DBAs to change the oracle password, that's not a good enough reason - You can do a great deal of damage with the oracle ID, so it has to be properly managed. Even better, make the DBAs log in with individual IDs and give those IDs sudo rights to switch to the oracle id.
If the other accounts are configured in multiple endpoints, e.g. scripts, that can make it harder to manage. But you need to know the procedure to change those passwords (including updating any login scripts). Then you can start to enforce regular rotation at a convenient time of day BEFORE the password actually expires.
Also consider using ssh keys instead of passwords, to you can keep better control of access without having to distribute passwords.
Of course, it also depends on how sensitive these accounts are. If the sftp user can't do much apart from get/put non-sensitive files, you can grant an exception in that case - e.g. change the password less often (but still keep track of who/where it is used)
Active today
Need to clarify on what's "Yes" esp for the following 2 :
Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
So in the case of our infrauser1 & 2, our setting of 0 is not adhering to best practice?
Q3:
For oracle account, what's the best/secure practice out there? min & maxage=0 ?
So it should be 1 & 7 respectively according to our security policy?
Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
So in the case of our infrauser1 & 2, our setting of 0 is not adhering to best practice?
Q3:
For oracle account, what's the best/secure practice out there? min & maxage=0 ?
So it should be 1 & 7 respectively according to our security policy?
Active today
Miss 1 item which was in the subject of the 1st posting:
In the same /etc/security/user,
default:
rlogin = true
Shouldn't rlogin be set to 'false' as rlogin doesn't require password & keys ?
In the same /etc/security/user,
default:
rlogin = true
Shouldn't rlogin be set to 'false' as rlogin doesn't require password & keys ?
Active 6 days ago
Apologies, I missed some of the points
Q2: Yes, individual settings override the system default, so these accounts are not compliant with your standard policy (I assume the defaults section settings match company policy, I'm pretty sure they've been tweaked from the settings on a fresh system install)
Q3: Yes, 1 and 8 (or just remove the "overrides") to match company policy. If you plan to change the password every 7 weeks, it will never expire. Even it does expire, cron jobs etc. will continue to run - only the login will be disabled.
The rlogin setting refers to remote login capability with rlogin/rsh/rexec AND telnet, so if you don't use those protocols any more then set rlogin=false. ssh/sftp and standard ftp will not be affected.
Q2: Yes, individual settings override the system default, so these accounts are not compliant with your standard policy (I assume the defaults section settings match company policy, I'm pretty sure they've been tweaked from the settings on a fresh system install)
Q3: Yes, 1 and 8 (or just remove the "overrides") to match company policy. If you plan to change the password every 7 weeks, it will never expire. Even it does expire, cron jobs etc. will continue to run - only the login will be disabled.
The rlogin setting refers to remote login capability with rlogin/rsh/rexec AND telnet, so if you don't use those protocols any more then set rlogin=false. ssh/sftp and standard ftp will not be affected.
Active 6 days ago
Hi sunhux - I'm happy to discuss this further if you want to.
EE prompted me to close the question and award myself points which seems a bit unethical - If you want it deleted, I have no objections!
Regards,
tfewster
EE prompted me to close the question and award myself points which seems a bit unethical - If you want it deleted, I have no objections!
Regards,
tfewster
Featured Post
Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address.
There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
Learn several ways to interact with files and get file information from the bash shell.
ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
In a previous video, we went over how to export a DynamoDB table into Amazon S3. In this video, we show how to load the export from S3 into a DynamoDB table.
Suggested Courses
Earn Certification
HTML5 Specialist - Certification
Free withPremium
Course of the Month7 days, 21 hours left to enroll
617 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.