Here's one more patch to clean up 'make validate' just a teensy bit more. This one required a lot of testing due to complicated regex.
- Maura Dailey
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- .../accounts_no_shelllogin_for_systemaccounts.xml | 23 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 2 +- 2 files changed, 24 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml new file mode 100644 index 0000000..a5b9334 --- /dev/null +++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml @@ -0,0 +1,23 @@ +<def-group> + <definition class="compliance" id="accounts_no_shelllogin_for_systemaccounts" version="1"> + <metadata> + <title>System Accounts Do Not Run a Shell</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The root account is the only system account that should have a login shell.</description> + </metadata> + <criteria> + <criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_accounts_no_shelllogin_for_systemaccounts" version="1"> + <ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1"> + ind:path/etc</ind:path> + ind:filenamepasswd</ind:filename> + <ind:pattern operation="pattern match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin).*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index f9b6aa2..1f2a840 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -158,7 +158,7 @@ section on the root account. Doing so might cause the system to become inaccessible. </warning> <ident cce="26966-2" /> -<oval id="no_shelllogin_for_systemaccounts" /> +<oval id="accounts_no_shelllogin_for_systemaccounts" /> <ref nist="" disa="178" /> <tested by="DS" on="20121024"/> </Rule>
On 7/19/13 6:15 PM, Maura Dailey wrote:
Here's one more patch to clean up 'make validate' just a teensy bit more. This one required a lot of testing due to complicated regex.
- Maura Dailey
Signed-off-by: Maura Daileymaura@eclipse.ncsc.mil
.../accounts_no_shelllogin_for_systemaccounts.xml | 23 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 2 +- 2 files changed, 24 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml new file mode 100644 index 0000000..a5b9334 --- /dev/null +++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml @@ -0,0 +1,23 @@ +<def-group>
<definition class="compliance" id="accounts_no_shelllogin_for_systemaccounts" version="1">
<metadata>
<title>System Accounts Do Not Run a Shell</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The root account is the only system account that should have a login shell.</description>
</metadata>
<criteria>
<criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_accounts_no_shelllogin_for_systemaccounts" version="1">
- <ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1">
- ind:path/etc</ind:path>
- ind:filenamepasswd</ind:filename>
- <ind:pattern operation="pattern match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin).*$</ind:pattern>
Seems to fail on the sync, shutdown, halt accounts
sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index f9b6aa2..1f2a840 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -158,7 +158,7 @@ section on the root account. Doing so might cause the system to become inaccessible.
</warning> <ident cce="26966-2" /> -<oval id="no_shelllogin_for_systemaccounts" /> +<oval id="accounts_no_shelllogin_for_systemaccounts" /> <ref nist="" disa="178" /> <tested by="DS" on="20121024"/> </Rule> -- 1.7.1 _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
I can add more exceptions. I'm more concerned that the prose is so vague.
- Maura Dailey
On 07/19/2013 10:04 PM, Shawn Wells wrote:
On 7/19/13 6:15 PM, Maura Dailey wrote:
Here's one more patch to clean up 'make validate' just a teensy bit more. This one required a lot of testing due to complicated regex.
- Maura Dailey
Signed-off-by: Maura Daileymaura@eclipse.ncsc.mil
.../accounts_no_shelllogin_for_systemaccounts.xml | 23 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 2 +- 2 files changed, 24 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml new file mode 100644 index 0000000..a5b9334 --- /dev/null +++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml @@ -0,0 +1,23 @@ +<def-group>
<definition class="compliance" id="accounts_no_shelllogin_for_systemaccounts" version="1">
<metadata>
<title>System Accounts Do Not Run a Shell</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The root account is the only system account that should have a login shell.</description>
</metadata>
<criteria>
<criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_accounts_no_shelllogin_for_systemaccounts" version="1">
- <ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1">
- ind:path/etc</ind:path>
- ind:filenamepasswd</ind:filename>
- <ind:pattern operation="pattern match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin).*$</ind:pattern>
Seems to fail on the sync, shutdown, halt accounts
sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
+</def-group> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index f9b6aa2..1f2a840 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -158,7 +158,7 @@ section on the root account. Doing so might cause the system to become inaccessible.
</warning> <ident cce="26966-2" /> -<oval id="no_shelllogin_for_systemaccounts" /> +<oval id="accounts_no_shelllogin_for_systemaccounts" /> <ref nist="" disa="178" /> <tested by="DS" on="20121024"/> </Rule> -- 1.7.1 _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-- Shawn Wells Director, Innovation Programs shawn@redhat.com | 443.534.0130 @shawndwells
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On Monday, July 22, 2013 12:00:13 PM Maura Dailey wrote:
I can add more exceptions. I'm more concerned that the prose is so vague.
Seems to fail on the sync, shutdown, halt accounts
sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt
This dates back to the 1980's. Back then, sudo didn't exist. So, to let non- admins do something "safe" they added these system accounts and set the shell to the admin action. So, if you needed to sync the disks, you just logged in under the sync account. To power off, you just logged in under shutdown.
These are no longer used as they once were. But they are there simply for historical reasons. The accounts could have their shell removed. But if a check is made, then you'd want to check that account name matches the program name before deciding it OK due to white list to prevent other shells from being substituted.
Looking at the prose:
<description>The root account is the only system account that should
have a login shell.</description>
I also think this is a problem. Its typical to login as the postgres or oracle user to perform admin tasks for that service.
-Steve
</metadata>
<criteria>
<criterion comment="tests for the presence of login shells (not
/sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
*grumble* Stupid historical exemptions!
Alright, is this a satisfactory patch to address sync/shutdown/halt? (I didn't do anything to address the prose yet, in case others wanted to weigh in.)
- Maura Dailey
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- .../accounts_no_shelllogin_for_systemaccounts.xml | 23 ++++++++++++++++++++ .../system/accounts/restrictions/root_logins.xml | 2 +- 2 files changed, 24 insertions(+), 1 deletions(-) create mode 100644 RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml new file mode 100644 index 0000000..ee59e0e --- /dev/null +++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml @@ -0,0 +1,23 @@ +<def-group> + <definition class="compliance" id="accounts_no_shelllogin_for_systemaccounts" version="1"> + <metadata> + <title>System Accounts Do Not Run a Shell</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The root account is the only system account that should have a login shell.</description> + </metadata> + <criteria> + <criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" /> + </criteria> + </definition> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_accounts_no_shelllogin_for_systemaccounts" version="1"> + <ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" /> + </ind:textfilecontent54_test> + <ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1"> + ind:path/etc</ind:path> + ind:filenamepasswd</ind:filename> + <ind:pattern operation="pattern match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin|/bin/sync|/sbin/shutdown|/sbin/halt).*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> + </ind:textfilecontent54_object> +</def-group> diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index f9b6aa2..1f2a840 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -158,7 +158,7 @@ section on the root account. Doing so might cause the system to become inaccessible. </warning> <ident cce="26966-2" /> -<oval id="no_shelllogin_for_systemaccounts" /> +<oval id="accounts_no_shelllogin_for_systemaccounts" /> <ref nist="" disa="178" /> <tested by="DS" on="20121024"/> </Rule>
On 7/22/13 4:43 PM, Maura Dailey wrote:
- <ind:pattern operation="pattern
match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin|/bin/sync|/sbin/shutdown|/sbin/halt).*$</ind:pattern>
Is this still outstanding?
My original thinking was that only the 'halt' user should have /sbin/halt as an acceptable shell, only 'shutdown' should have /sbin/shutdown, etc, however the security gains for this seem incredibly trivial.
This is a marked improvement. If someone has a strong enough opinion on only having /sbin/halt assigned to halt, patches welcome :)
Ack from me.
I'll push it then, and if someone wants to come back and change it again, they can.
- Maura Dailey
On 07/31/2013 02:06 PM, Shawn Wells wrote:
On 7/22/13 4:43 PM, Maura Dailey wrote:
- <ind:pattern operation="pattern
match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!/sbin/nologin|/bin/sync|/sbin/shutdown|/sbin/halt).*$</ind:pattern>
Is this still outstanding?
My original thinking was that only the 'halt' user should have /sbin/halt as an acceptable shell, only 'shutdown' should have /sbin/shutdown, etc, however the security gains for this seem incredibly trivial.
This is a marked improvement. If someone has a strong enough opinion on only having /sbin/halt assigned to halt, patches welcome :)
Ack from me. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org