On 07/23/2013 02:49 PM, Steve Grubb wrote:
I don't think this benchmark addressed network based user
accounts.
I'm not even sure there is proper support in OVAL for that. If it did,
it would require a specific pam setup, or NIS+, or sssd. Because of
the variations in how to do it, I don't think there is a clear cut
best way to do it. So, I'd only concentrate on local users and leave
network users out for now.
Would (not) systems which extend the authentication domain with network
based accounts show false positives on such tests based solely on uids
and gids from /etc/passwd and /etc/group?