*grumble* Stupid historical exemptions!
Alright, is this a satisfactory patch to address sync/shutdown/halt? (I
didn't do anything to address the prose yet, in case others wanted to
weigh in.)
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
.../accounts_no_shelllogin_for_systemaccounts.xml | 23
++++++++++++++++++++
.../system/accounts/restrictions/root_logins.xml | 2 +-
2 files changed, 24 insertions(+), 1 deletions(-)
create mode 100644
RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
diff --git
a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
new file mode 100644
index 0000000..ee59e0e
--- /dev/null
+++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
@@ -0,0 +1,23 @@
+<def-group>
+ <definition class="compliance"
id="accounts_no_shelllogin_for_systemaccounts" version="1">
+ <metadata>
+ <title>System Accounts Do Not Run a Shell</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The root account is the only system account that
should have a login shell.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="tests for the presence of login shells (not
/sbin/nologin) for system accounts in /etc/passwd file"
test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist"
comment="tests for the presence of login shells (not /sbin/nologin) for
system accounts in /etc/passwd file"
id="test_accounts_no_shelllogin_for_systemaccounts" version="1">
+ <ind:object
object_ref="object_accounts_no_shelllogin_for_systemaccounts" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_accounts_no_shelllogin_for_systemaccounts" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>passwd</ind:filename>
+ <ind:pattern operation="pattern
match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml
b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index f9b6aa2..1f2a840 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -158,7 +158,7 @@ section on the root account. Doing so might cause
the system to
become inaccessible.
</warning>
<ident cce="26966-2" />
-<oval id="no_shelllogin_for_systemaccounts" />
+<oval id="accounts_no_shelllogin_for_systemaccounts" />
<ref nist="" disa="178" />
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
On 07/22/2013 01:53 PM, Steve Grubb wrote:
On Monday, July 22, 2013 12:00:13 PM Maura Dailey wrote:
> I can add more exceptions. I'm more concerned that the prose is so vague.
>
>> Seems to fail on the sync, shutdown, halt accounts
>>
>> sync:x:5:0:sync:/sbin:/bin/sync
>> shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
>> halt:x:7:0:halt:/sbin:/sbin/halt
This dates back to the 1980's. Back then, sudo didn't exist. So, to let non-
admins do something "safe" they added these system accounts and set the shell
to the admin action. So, if you needed to sync the disks, you just logged in
under the sync account. To power off, you just logged in under shutdown.
These are no longer used as they once were. But they are there simply for
historical reasons. The accounts could have their shell removed. But if a
check is made, then you'd want to check that account name matches the program
name before deciding it OK due to white list to prevent other shells from
being substituted.
Looking at the prose:
>> + <description>The root account is the only system account that
should
have a login shell.</description>
I also think this is a problem. Its typical to login as the postgres or oracle
user to perform admin tasks for that service.
-Steve
>> + </metadata>
>> + <criteria>
>> + <criterion comment="tests for the presence of login shells (not
/sbin/nologin) for system accounts in /etc/passwd file"
test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide