STIGQter STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

TOSS must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

DISA Rule

SV-252954r958508_rule

Vulnerability Number

V-252954

Group Title

SRG-OS-000123-GPOS-00064

Rule Version

TOSS-04-020140

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If an emergency account must be created, configure the system to terminate the account after 72 hours with the following command to set an expiration date for the account. Substitute "system_account_name" with the account to be created.

$ sudo chage -E `date -d "+3 days" +%Y-%m-%d` system_account_name

The automatic expiration or disabling time period may be extended as needed until the crisis is resolved.

Check Contents

Verify emergency accounts have been provisioned with an expiration date of 72 hours.

For every existing emergency account, run the following command to obtain its account expiration information.

$ sudo chage -l system_account_name

Verify each of these accounts has an expiration date set within 72 hours. If any emergency accounts have no expiration date set or do not expire within 72 hours, this is a finding.

If there are no emergency accounts configured, this requirement is Not Applicable.

Vulnerability Number

V-252954

Documentable

False

Rule Version

TOSS-04-020140

Severity Override Guidance

Verify emergency accounts have been provisioned with an expiration date of 72 hours.

For every existing emergency account, run the following command to obtain its account expiration information.

$ sudo chage -l system_account_name

Verify each of these accounts has an expiration date set within 72 hours. If any emergency accounts have no expiration date set or do not expire within 72 hours, this is a finding.

If there are no emergency accounts configured, this requirement is Not Applicable.

Check Content Reference

M

Target Key

5469