id: pwpolicy_minimum_lifetime_enforce
title: Set Minimum Password Lifetime to $ODV Hours
discussion: |
  The macOS _MUST_ be configured to enforce a minimum password lifetime limit of $ODV hours.

  This rule discourages users from cycling through their previous passwords to get back to a preferred one.

  NOTE: To comply with Executive Order 14028, “Improving the Nation's Cybersecurity”, OMB M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, and NIST SP-800-63b, “Digital Identity Guidelines: Authentication and Lifecycle Management” federal, military, and intelligence communities must adopt the following configuration settings. Password policies must not require the use of complexity policies such as upper characters, lower characters, or special characters. Password policies must also not require the use of regular rotation. Password policies should define a minimum length. Multifactor authentication should be used where ever possible.
check: |
  /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= $ODV ) {print "pass"} else {print "fail"}}'
result:
  string: 'pass'
fix: |
  This setting may be enforced using local policy or by a directory service.

  To set local policy to require a minimum password lifetime, edit the current password policy to contain the following <dict> within the "policyCategoryPasswordContent":

  [source,xml]
  ----
  <dict>
  <key>policyContent</key>
  <string>policyAttributeLastPasswordChangeTime &lt; policyAttributeCurrentTime - (policyAttributeMinimumLifetimeHours * 60 * 60)</string>
  <key>policyIdentifier</key>
  <string>Minimum Password Lifetime</string>
  <key>policyParameters</key>
  <dict>
  <key>policyAttributeMinimumLifetimeHours</key>
  <integer>$ODV</integer>
  </dict>
  </dict>
  ----
  After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".

  [source,bash]
  ----
  /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
  ----
  NOTE: See the password policy supplemental on more information on how to implement password policies on macOS.
references:
  cce:
    - CCE-94341-5
  cci:
    - CCI-000198
    - CCI-004066
  800-53r5:
    - IA-5
  800-53r4:
    - IA-5(1)
  disa_stig:
    - APPL-15-003070
  srg:
    - SRG-OS-000075-GPOS-00043
  800-171r3:
    - 03.05.12
  cis:
    benchmark:
      - N/A
    controls v8:
      - 4.7
  cmmc:
    - IA.L2-3.5.8
    - IA.L2-3.5.9
macOS:
  - '15.0'
odv:
  hint: Number of hours.
  recommended: 24
  stig: 24
tags:
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: false
mobileconfig_info:
