Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

AIX minage & maxage & rlogin  in default & indiv ids

Posted on 2016-09-27
6
Medium Priority
?
130 Views
Last Modified: 2016-11-01
In /etc/security/user,  we have
default:
      admin = false
      login = true
      su = false
      daemon = true
      rlogin = true
        . . .
      minage = 1
      maxage = 8
      mindiff = 3
      maxrepeats = 2
      dictionlist =
      pwdchecks =

oracle:
      minage = 0
      maxage = 0

infrauser1:
      minage = 0
      maxage = 0

sshuser:
      admin = false
      maxage = 0

infrauser2:
      minage = 0
      maxage = 0


Q1:
For infrauser1 & 2, shouldn't the minage=1 & maxage=8 to match with the default & security best practice?

Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?

Q3:
For oracle account, what's the best/secure practice out there?  min & maxage=0 ?

Q4:
for sshuser used to do sftp, what's the best/secure practice out there?  min & maxage=0 ?
0
Comment
Question by:sunhux
  • 4
  • 2
6 Comments
 
LVL 21

Accepted Solution

by:
tfewster earned 2000 total points (awarded by participants)
ID: 41819002
Q1: Yes, it should match your security policy (I assume the defaults reflect that policy)
Q2: Yes, it should match your security policy
Q3: It should match your security policy
Q4: It should match your security policy

I know this is a simplistic view, but it's best security practice. If it's merely inconvenient for the DBAs to change the oracle password, that's not a good enough reason - You can do a great deal of damage with the oracle ID, so it has to be properly managed. Even better, make the DBAs log in with individual IDs and give those IDs sudo rights to switch to the oracle id.

If the other accounts are configured in multiple endpoints, e.g. scripts, that can make it harder to manage.  But you need to know the procedure to change those passwords (including updating any login scripts). Then you can start to enforce regular rotation at a convenient time of day BEFORE the password actually expires.

Also consider using ssh keys instead of passwords, to you can keep better control of access without having to distribute passwords.

Of course, it also depends on how sensitive these accounts are. If the sftp user can't  do much apart from get/put non-sensitive files, you can grant an exception in that case - e.g. change the password less often (but still keep track of who/where it is used)
0
 

Author Comment

by:sunhux
ID: 41819039
Need to clarify on what's "Yes" esp for the following 2 :

Q2:
 with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
 So in the case of our infrauser1 & 2, our setting of 0 is not adhering to best practice?

 Q3:
 For oracle account, what's the best/secure practice out there?  min & maxage=0 ?
 So it should be 1 & 7 respectively according to our security policy?
0
 

Author Comment

by:sunhux
ID: 41819073
Miss 1 item which was in the subject of the 1st posting:

In the same /etc/security/user,
default:          
                rlogin = true  

Shouldn't rlogin be set to  'false' as rlogin doesn't require password & keys ?
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 21

Assisted Solution

by:tfewster
tfewster earned 2000 total points (awarded by participants)
ID: 41820940
Apologies, I missed some of the points
Q2: Yes, individual settings override the system default, so these accounts are not compliant with your standard policy (I assume the defaults section settings match company policy, I'm pretty sure they've been tweaked from the settings on a fresh system install)

Q3: Yes, 1 and 8 (or just remove the "overrides") to match company policy. If you plan to change the password every 7 weeks, it will never expire. Even it does expire, cron jobs etc. will continue to run - only the login will be disabled.

The rlogin setting refers to remote login capability with rlogin/rsh/rexec AND telnet, so if you don't use those protocols any more then set rlogin=false. ssh/sftp and standard ftp will not be affected.
0
 
LVL 21

Expert Comment

by:tfewster
ID: 41842559
Hi sunhux - I'm happy to discuss this further if you want to.

EE prompted me to close the question and award myself points which seems a bit unethical - If you want it deleted, I have no objections!

Regards,
tfewster
0
 
LVL 21

Expert Comment

by:tfewster
ID: 41868053
No further responses from user
0

Featured Post

WatchGuard Case Study: Museum of Flight

“With limited money and limited staffing, we didn’t have a lot of choices in terms of what we could do to bring efficiency. WatchGuard played a central part in changing that.” To provide strong, secure Wi-Fi access within the museum, Hunter chose to deploy WatchGuard’s AP120 APs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

FreeBSD on EC2 FreeBSD (https://www.freebsd.org) is a robust Unix-like operating system that has been around for many years. FreeBSD is available on Amazon EC2 through Amazon Machine Images (AMIs) provided by FreeBSD developer and security office…
Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.
Suggested Courses
Course of the Month12 days, 14 hours left to enroll

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question