Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The DBMS must enforce password maximum lifetime restrictions.
Description
Discussion Text
Password maximum lifetime is the maximum period of time, (typically in days) a user's password may be in effect before the user is forced to change it.
Passwords need to be changed at specific policy-based intervals as per policy. Any password, no matter how complex, can eventually be cracked.
One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.
The "PASSWORD_LIFE_TIME" parameter defines the number of days a password remains valid. This can, but must not be, set to "UNLIMITED". Further, the "PASSWORD_GRACE_TIME" parameter, if set to "UNLIMITED", can nullify the "PASSWORD_LIFE_TIME". "PASSWORD_GRACE_TIME" must be set to "0" days (or another small integer).
Note that user authentication and account management must be done via an enterprise-wide mechanism whenever possible. Examples of enterprise-level authentication/access mechanisms include, but are not limited to, Active Directory and LDAP. With respect to Oracle, this requirement applies to cases where it is necessary to have accounts directly managed by Oracle.
Passwords need to be changed at specific policy-based intervals as per policy. Any password, no matter how complex, can eventually be cracked.
One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.
The "PASSWORD_LIFE_TIME" parameter defines the number of days a password remains valid. This can, but must not be, set to "UNLIMITED". Further, the "PASSWORD_GRACE_TIME" parameter, if set to "UNLIMITED", can nullify the "PASSWORD_LIFE_TIME". "PASSWORD_GRACE_TIME" must be set to "0" days (or another small integer).
Note that user authentication and account management must be done via an enterprise-wide mechanism whenever possible. Examples of enterprise-level authentication/access mechanisms include, but are not limited to, Active Directory and LDAP. With respect to Oracle, this requirement applies to cases where it is necessary to have accounts directly managed by Oracle.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.