>From 4881f094da76e14a31124de5cb8f41c83f60d6d8 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 25 Apr 2013 18:59:36 -0400 Subject: [PATCH 29/64] Mapped IA-2 against no_uidzero_except_root sshd_disable_root_login and new no_direct_root_logins - IA-2 against no_uidzero_except_root to ensure no other accounts have priv access - IA-2(1) against sshd_disable_root_login to ensure users do not remote into the machine directly as root - New no_direct_root_logins to ensure users first login as nonpriv account and escalate to root --- RHEL6/input/services/ssh.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 35 +++++++++++++++++++- 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 40cad5a..d9de675 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -265,7 +265,7 @@ and also allows direct attack attempts on root's password. - + diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index dd0e9ef..e855d8e 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -35,6 +35,39 @@ console interface may be retained for backwards compatibility:
vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 ...
--> + +Direct root Logins Not Allowed +To further limit access to the root account, administrators +can disable root logins at the console by editing the /etc/secuetty file. +This file lists all devices the root user is allowed to login to. If the file does +not exist at all, the root user can login through any communication device on thesyste, +whether via the console or a raw network interface. This is dangerous as as user can login to +his machine as root via Telnet, which sends the passowrd in plain text over the network. +By default, Red Hat Enteprise Linux's /etc/securetty file only allows the root user +to login at the console physically attached to the machine. To prevent root from logging in, +remove the contents of this file. To prevent direct root logins, remove the contents of this +file by typing the following command: +
+echo > /etc/securetty
+
+ +To ensure root may not directly login to the system over physical consoles, +run the following command: +
cat /etc/securetty
+If any output is returned, this is a finding. +
+ +Disabling direct root logins ensures proper accountability and multifactor +authentication to privileged accounts. Users will first login, then escalate +to privileged (root) access via su/sudo. This is required for FISMA Low +and FISMA Moderate systems. + + + + + +
+ Restrict Virtual Console Root Logins @@ -167,7 +200,7 @@ access to root privileges in an accountable manner. - + -- 1.7.1