Hi mpreisler,
Thanks for you suggestion in IRC.
This what I have so far, but it is still not working. I feel I am close, but it is not working yet. I would appreciate any suggestion
<def-group>
<definition class="compliance" id="at_system_accounts" version="1">
<metadata>
<title>No system accounts in /etc/at.allow</title>
<affected family="unix">
<platform>CentOS 5</platform>
<platform>Red Hat Enterprise Linux 5</platform>
</affected>
<description>Group owner for /etc/at.allow and /etc/at.deny must exist.</description>
</metadata>
<criteria>
<criterion test_ref="test_at_system_accounts_at_allow" />
</criteria>
</definition>
<!-- This variable should get all users from /etc/passwd that has UID >= 500 -->
<local_variable id="var_at_system_accounts_allow_list" comment="Accounts Allowed" datatype="string" version="1">
<object_component item_field="subexpression" object_ref="object_at_system_accounts_allow_list" />
</local_variable>
<ind:textfilecontent54_object id="object_at_system_accounts_allow_list" version="1">
<ind:filepath>/etc/passwd</ind:filepath>
<ind:pattern operation="pattern match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
<filter action="include">state_at_system_accounts_etc_passwd</filter>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_at_system_accounts_etc_passwd" version="1">
<ind:filepath>/etc/passwd</ind:filepath>
<ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
<ind:subexpression operation="greater than or equal" datatype="int">500</ind:subexpression>
</ind:textfilecontent54_state>
<!-- Test to check that there is no system accounts in /etc/at.allow -->
<ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_at_system_accounts_at_allow" comment="Testing /etc/at.allow for system accounts" version="1">
<ind:object object_ref="object_at_system_accounts_allow" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object comment="/etc/at.allow" id="object_at_system_accounts_allow" version="1">
<!-- Get all users from /etc/at.allow -->
<ind:filepath>/etc/at.allow</ind:filepath>
<ind:pattern operation="pattern match">^(.+)$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
<!-- Exclude root -->
<filter action="exclude">state_at_system_accounts_at_allow_root</filter>
<!-- Exclude all user accounts -->
<filter action="exclude">state_at_system_accounts_at_allow_uid</filter>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_at_system_accounts_at_allow_root" version="1">
<ind:text>root</ind:text>
</ind:textfilecontent54_state>
<unix:password_state id="state_at_system_accounts_at_allow_uid" version="1">
<unix:username var_ref="var_at_system_accounts_allow_list" var_check="at least one" />
</unix:password_state>
</def-group>
--
Rodolfo