>From b1043abacb74c1f87fb634e759191a30506e06e7 Mon Sep 17 00:00:00 2001 From: steinkel Date: Mon, 9 Dec 2013 15:11:27 -0500 Subject: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts --- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- .../checks/locked_password_for_systemaccounts.xml | 34 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 33 +++++++++++++++++++ 3 files changed, 68 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/locked_password_for_systemaccounts.xml diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 32eb751..05075e4 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -72,7 +72,7 @@ The system must prevent the root account from logging in from serial consoles. - + Default system accounts, other than root, must be locked. diff --git a/RHEL6/input/checks/locked_password_for_systemaccounts.xml b/RHEL6/input/checks/locked_password_for_systemaccounts.xml new file mode 100644 index 0000000..e1ce5bf --- /dev/null +++ b/RHEL6/input/checks/locked_password_for_systemaccounts.xml @@ -0,0 +1,34 @@ + + + + Locked System Accounts + + Red Hat Enterprise Linux 6 + + The root account is the only system account that should not be locked. + + + + + + + + + + /etc/passwd + ^(?!root)([^:]+):x:(?:0*[0-9]{1,2}|[1-4][0-9]{2}):.*$ + 1 + + + /etc/shadow + + 1 + + + + ^ + + :[^!*] + + + diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index 119931b..3a765a2 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -167,6 +167,39 @@ become inaccessible. + +Ensure that System Accounts Are Locked + +Some accounts are not associated with a human +user of the system, and exist to perform some administrative +function. An attacker should not be able to log into these accounts. +
+Disable login access to these accounts with the command: +
# passwd -l SYSACCT
+
+ +To obtain a listing of all users and the content of their shadow +password field, run the command: +
$ awk -F: '{print $1 ":" $2}' /etc/shadow
+Identify the system accounts from this listing. These will +primarily be the accounts with UID numbers less than 500, other +than root. +
+ +Disabling authentication for default system accounts +makes it more difficult for attackers to make use of +them to compromise a system. + + +Do not perform the steps in this +section on the root account. Doing so might cause the system to +become inaccessible. + + + +
+ + Verify Only Root Has UID 0 -- 1.7.1