Description

Ensure IAM local user passwords are changed on a regular schedule, and immediately if a password may have been exposed, so that old passwords do not stay valid indefinitely. Users should also enable two-factor authentication on their own login.

Rationale

Passwords that are never changed can be reused for a long time if they are leaked, phished, or reused on other sites. Regular rotation limits how long a compromised password can be used. Because OVHcloud does not expire local user passwords automatically, rotation must be part of a documented process.

Impact

  • Limits how long a leaked password stays valid

  • Supports password policy and compliance requirements

  • Users must update their saved passwords

Default Value

OVHcloud does not automatically expire IAM local user passwords.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

  • A defined password rotation period

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Review each local user and check, using your records, when its password was last changed.

  5. If any password is older than your rotation period, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Open the ⋯ menu for the local user and edit the user to set a new password.

  5. Set a new strong password, or ask the user to change it from their own account.

  6. Record the change date and repeat on your defined schedule.

Backout Plan

  1. If a user cannot sign in, set a new password for them from the Identities page.

Reference