On Monday, July 22, 2013 12:00:13 PM Maura Dailey wrote:
I can add more exceptions. I'm more concerned that the prose is
so vague.
> Seems to fail on the sync, shutdown, halt accounts
>
> sync:x:5:0:sync:/sbin:/bin/sync
> shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
> halt:x:7:0:halt:/sbin:/sbin/halt
This dates back to the 1980's. Back then, sudo didn't exist. So, to let non-
admins do something "safe" they added these system accounts and set the shell
to the admin action. So, if you needed to sync the disks, you just logged in
under the sync account. To power off, you just logged in under shutdown.
These are no longer used as they once were. But they are there simply for
historical reasons. The accounts could have their shell removed. But if a
check is made, then you'd want to check that account name matches the program
name before deciding it OK due to white list to prevent other shells from
being substituted.
Looking at the prose:
> + <description>The root account is the only system
account that should
have a login shell.</description>
I also think this is a problem. Its typical to login as the postgres or oracle
user to perform admin tasks for that service.
-Steve
> + </metadata>
> + <criteria>
> + <criterion comment="tests for the presence of login shells (not
/sbin/nologin) for system accounts in /etc/passwd file"
test_ref="test_accounts_no_shelllogin_for_systemaccounts" />