On Tuesday, July 23, 2013 03:10:09 PM Gary Gapinski wrote:
On 07/23/2013 02:49 PM, Steve Grubb wrote:
> I don't think this benchmark addressed network based user accounts.
> I'm not even sure there is proper support in OVAL for that. If it did,
> it would require a specific pam setup, or NIS+, or sssd. Because of
> the variations in how to do it, I don't think there is a clear cut
> best way to do it. So, I'd only concentrate on local users and leave
> network users out for now.
Would (not) systems which extend the authentication domain with network
based accounts show false positives on such tests based solely on uids
and gids from /etc/passwd and /etc/group?
Probably. But the places that you might run into this is limited, /var/spool,
/var/mail, /home, /tmp. But looking at the guide, 2.4.1.2, its clearly talking
about /etc/passwd and groups. And nowhere else do I see guidance on how to
configure remote authentication. Like I said, I don't know if OVAL can even
support remote user lookup given 3 or 4 ways to do it.
I'd also be curious if the find command gets it right.
-Steve