RHEL7 STIG: CCI-000016 The operating system must automatically remove or disable temporary user accounts after 72 hours.

[shawndwells]

CCI-000016 SRG-OS-000002 The operating system must automatically remove or disable temporary user accounts after 72 hours. "If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.

Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation.

If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours.

To address access requirements, many operating systems may be integrated with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements. "

[shawndwells]

AC-2 (2)

[redhatrises]

@shawndwells can this be closed with the merging of #349? Seems like this should have auto-closed with the merge, but I just wanted to make sure that it wasn't open for another reason.

[shawndwells]

not yet. looks like the CCE has been reused in RHEL6/7:

$ grep -rin 26436-6 *
6/input/system/software/disk_partitioning.xml:101:<ident cce="26436-6"  stig="RHEL-06-000004" />
6/kickstart/usgcb-server-with-gui-ks.cfg:107:# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition
7/input/system/accounts/restrictions/account_expiration.xml:105:<ident cce="26436-6" />

and likely the xccdf needs to be added to stig profile.

I'll do this now.

[shawndwells]

(p.s. @redhatrises thank you so much for helping to clear out the tickets!)

[shawndwells]

@redhatrises updated and submitted PR for your review