attempt 2... Re: Seeking Input: CCI-001459 Remediation - Temp Account Termination

Steve Grubb sgrubb at redhat.com
Thu Apr 26 12:19:06 UTC 2012


On Thursday, April 26, 2012 12:00:34 AM Shawn Wells wrote:
> >>> Hey Guys,
> >>> 
> >>> CCI-001459 requires that temp accounts be terminated after a
> >>> organizationally defined period of time. Right now we don't have
> >>> a check/control that implements that.

The best suggestion on doing this is with a cron job that scans the accounts and 
compares with "lastlog". As long as the accounts are local and not LDAP based, 
you are OK.


> >>> I'd like to add prose that recommends that -ALL- accounts be
> >>> locked after 60 (or  90... or 120..) days of inactivity. This
> >>> would allow us to automatically meet CCI-001459 and enforces that
> >>> inactive accounts should (eventually and automatically) be
> >>> frozen.
> >>> 
> >>> Thoughts? My thinking is that 90 days of inactivity is a good
> >>> number.
> >> 
> >> Sitting in a room with Willy Santos, and he just brought up a good
> >> point. This really should be broken into 2 rules:
> >> 
> >> #1:  All accounts should be disabled after 90 days inactivity
> > 
> > How do you measure activity? login? checked email? logged in via ftp?
> > Not all accounts are used to login. Also what happens if you use
> > central admin like ldap/etc.

Activity is measured by the "lastlog" command. This is its whole purpose in 
life.


> Originally I was thinking we could do a `lastlog -u USER`, but in 
> testing that:
> 
> [shawn at rhel6 scap-security-guide]$ lastlog -u shawn
> Username         Port     From             Latest
> shawn            pts/1    10.211.55.2      Tue Apr 24 15:16:22 -0400 2012
> 
> [shawn at rhel6 scap-security-guide]$ lastlog -u root
> Username         Port     From             Latest
> root                                    **Never logged in**

You should leave a loophole for root. Locking it is _never_ a good thing to do. 
:)


> When I sudo to root and re-run:
> [root at rhel6 ~]# lastlog -u root
> Username         Port     From             Latest
> root             tty1                      Wed Dec 14 19:40:50 -0500 2011
> 
> This could be fine (force the scan to run as root), however when I check 
> a service account:
> [root at rhel6 ~]# lastlog -u apache
> Username         Port     From             Latest
> apache                                     **Never logged in**
> 
> 
> I checked out wtmp and a few other methods to no avail. Perhaps we can 
> recommend "real" users to have a certain group membership, and we can 
> lastlog -u all users in that group?

So, what's wrong here? Apache never logged in. Lock the account. It won't hurt 
apache since it does not use pam to become apache. Locking the account only 
affects pam. You also want to take the additional step of expiring the account.

Account locking stops password based logins. It does nothing for key based 
logins. Expiring the account stops all logins.

We have created a new option to pam_lastlog to block unused accounts after an 
expiration time. We could possbly backport this to RHEL6 if we need to. But 
lastlog has the right information in it.

-Steve


More information about the scap-security-guide mailing list