<Group id="account_expiration">
<title>Set Account Expiration Parameters</title>
<description>Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <tt><i>NUM_DAYS</i></tt> and <tt><i>USER</i></tt> appropriately:
<pre>$ sudo chage -I <i>NUM_DAYS USER</i></pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<tt>-E</tt> option.
The file <tt>/etc/default/useradd</tt> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.
</description>

<Value id="var_account_disable_post_pw_expiration" type="number" >
<title>number of days after a password expires until the account is permanently disabled</title>
<description>The number of days to wait after a password expires, until the account will be permanently disabled.</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">35</value>
<value selector="30">30</value>
<value selector="35">35</value>
<value selector="60">60</value>
<value selector="90">90</value>
<value selector="180">180</value>
</Value>

<Rule id="account_disable_post_pw_expiration">
<title>Set Account Expiration Following Inactivity</title>
<description>To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following lines in <tt>/etc/default/useradd</tt>, substituting
<tt><i>NUM_DAYS</i></tt> appropriately:
<pre>INACTIVE=<i><sub idref="account_disable_post_pw_expiration"/></i></pre>
A value of 35 is recommended.  
If a password is currently on the
verge of expiration, then 35 days remain until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 95
days could elapse until the account would be automatically disabled. See the
<tt>useradd</tt> man page for more information.  Determining the inactivity
timeout must be done with careful consideration of the length of a "normal"
period of inactivity for users in the particular environment. Setting
the timeout too low incurs support costs and also has the potential to impact
availability of the system to legitimate users.
</description>
<ocil clause="it does not">
To verify the <tt>INACTIVE</tt> setting, run the following command:
<pre>grep "INACTIVE" /etc/default/useradd</pre>
The output should indicate the <tt>INACTIVE</tt> configuration option is set
to an appropriate integer as shown in the example below:
<pre>$ sudo grep "INACTIVE" /etc/default/useradd
INACTIVE=<sub idref="account_disable_post_pw_expiration"/></pre></ocil>
<rationale>
Disabling inactive accounts ensures that accounts which may not
have been responsibly removed are not available to attackers
who may have compromised their credentials.
</rationale>
<ident cce="TBD" />
<oval id="account_disable_post_pw_expiration" value="var_account_disable_post_pw_expiration"/>
<ref nist="AC-2(2), AC-2(3)" disa="16,17,795"/>
</Rule>

<Rule id="account_unique_name">
<title>Ensure All Accounts on the System Have Unique Names</title>
<description>
Change usernames, or delete accounts, so each has a unique name.
</description>
<ocil clause="a line is returned">
Run the following command to check for duplicate account names:
<pre>$ sudo pwck -qr</pre>
If there are no duplicate names, no line will be returned.
</ocil>
<rationale>
Unique usernames allow for accountability on the system. 
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<ref disa="770,804"/>
</Rule>

<Rule id="account_temp_expire_date">
<title>Assign Expiration Date to Temporary Accounts</title>
<description>
Temporary accounts are established as part of normal account activation procedures
when there is a need for short-term accounts. In the event temporary 
or emergency accounts are required, configure the system to terminate 
them after a documented time period. For every temporary and
emergency account, run the following command to set an expiration date on it,
substituting <tt><i>USER</i></tt> and <tt><i>YYYY-MM-DD</i></tt> appropriately:
<pre>$ sudo chage -E <i>YYYY-MM-DD USER</i></pre>
<tt><i>YYYY-MM-DD</i></tt> indicates the documented expiration date for the account.
For U.S. Government systems, the operating system must be configured to automatically terminate
these typoes of accounts after a period of 72 hours.
</description>
<ocil clause="any temporary or emergency accounts have no expiration date set or do not expire within a documented time frame">
For every temporary and emergency account, run the following command
to obtain its account aging and expiration information:
<pre>$ sudo chage -l <i>USER</i></pre>
Verify each of these accounts has an expiration date set as documented.
</ocil>
<rationale>
If temporary user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all temporary accounts
must be set upon account creation.
<br/>
</rationale>
<ident cce="27498-5" />
<ref nist="AC-2(2),AC-2(3)" disa="16,1682" ossrg="2" />
</Rule>

</Group>
