I'll push it then, and if someone wants to come back and change it
again, they can.
- Maura Dailey
On 07/31/2013 02:06 PM, Shawn Wells wrote:
On 7/22/13 4:43 PM, Maura Dailey wrote:
>
> + <ind:pattern operation="pattern
>
match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
Is this still outstanding?
My original thinking was that only the 'halt' user should have
/sbin/halt as an acceptable shell, only 'shutdown' should have
/sbin/shutdown, etc, however the security gains for this seem
incredibly trivial.
This is a marked improvement. If someone has a strong enough opinion
on only having /sbin/halt assigned to halt, patches welcome :)
Ack from me.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide