On Thursday, April 26, 2012 12:00:34 AM Shawn Wells wrote:
>>> Hey Guys,
>>>
>>> CCI-001459 requires that temp accounts be terminated after a
>>> organizationally defined period of time. Right now we don't have
>>> a check/control that implements that.
The best suggestion on doing this is with a cron job that scans the accounts and
compares with "lastlog". As long as the accounts are local and not LDAP based,
you are OK.
>>> I'd like to add prose that recommends that -ALL-
accounts be
>>> locked after 60 (or 90... or 120..) days of inactivity. This
>>> would allow us to automatically meet CCI-001459 and enforces that
>>> inactive accounts should (eventually and automatically) be
>>> frozen.
>>>
>>> Thoughts? My thinking is that 90 days of inactivity is a good
>>> number.
>>
>> Sitting in a room with Willy Santos, and he just brought up a good
>> point. This really should be broken into 2 rules:
>>
>> #1: All accounts should be disabled after 90 days inactivity
>
> How do you measure activity? login? checked email? logged in via ftp?
> Not all accounts are used to login. Also what happens if you use
> central admin like ldap/etc.
Activity is measured by the "lastlog" command. This is its whole purpose in
life.
Originally I was thinking we could do a `lastlog -u USER`, but in
testing that:
[shawn@rhel6 scap-security-guide]$ lastlog -u shawn
Username Port From Latest
shawn pts/1 10.211.55.2 Tue Apr 24 15:16:22 -0400 2012
[shawn@rhel6 scap-security-guide]$ lastlog -u root
Username Port From Latest
root **Never logged in**
You should leave a loophole for root. Locking it is _never_ a good thing to do.
:)
When I sudo to root and re-run:
[root@rhel6 ~]# lastlog -u root
Username Port From Latest
root tty1 Wed Dec 14 19:40:50 -0500 2011
This could be fine (force the scan to run as root), however when I check
a service account:
[root@rhel6 ~]# lastlog -u apache
Username Port From Latest
apache **Never logged in**
I checked out wtmp and a few other methods to no avail. Perhaps we can
recommend "real" users to have a certain group membership, and we can
lastlog -u all users in that group?
So, what's wrong here? Apache never logged in. Lock the account. It won't hurt
apache since it does not use pam to become apache. Locking the account only
affects pam. You also want to take the additional step of expiring the account.
Account locking stops password based logins. It does nothing for key based
logins. Expiring the account stops all logins.
We have created a new option to pam_lastlog to block unused accounts after an
expiration time. We could possbly backport this to RHEL6 if we need to. But
lastlog has the right information in it.
-Steve