[PATCH] added rule requiring unique usernames

David Smith dsmith at eclipse.ncsc.mil
Tue Oct 9 21:23:37 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/auxiliary/srg_support.xml              |    2 +-
 RHEL6/input/auxiliary/transition_notes.xml         |    5 ++++-
 .../accounts/restrictions/account_expiration.xml   |   16 ++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/auxiliary/srg_support.xml b/RHEL6/input/auxiliary/srg_support.xml
index 5e41a6b..376f616 100644
--- a/RHEL6/input/auxiliary/srg_support.xml
+++ b/RHEL6/input/auxiliary/srg_support.xml
@@ -12,7 +12,7 @@ not clearly relate.
 Red Hat Enterprise Linux meets this requirement by design.
 <!-- We could include discussion of Common Criteria Testing if so desired here. -->
 </description>
-<ref disa="56,66,223,131,132,133,134,159,1694,162,163,164,345,346,872,1493,1494,1495,226,1096,1111,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
+<ref disa="56,66,223,131,132,133,134,159,1694,770,804,162,163,164,345,346,872,1493,1494,1495,226,1096,1111,386,34,35,156,186,99,1083,1089,1082,804,1209,1214,1237,1248,1265,1269,1314,1362,1368,1310,1311,1328,1399,1400,1425,1427,1499,1693,1665,1670,1674,206,154" />
 </Group> <!-- end met_inherently -->
 
 <Group id="unmet_impractical_guidance">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index c057d8e..437da15 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -811,7 +811,7 @@ This is desirable but not practical in many environments.  Notably, many other O
 do not even support this capability.
 </note>
 
-<note ref="761,776,777,780,781,782,4382,11975,12765" auth="JB">
+<note ref="776,777,780,781,782,4382,11975,12765" auth="JB">
 This needs to be added to the RHEL6 content.
 </note>
 
@@ -1634,4 +1634,7 @@ exist.
 rule=sshd_enable_warning_banner manual=no
 </note>
 
+<note ref="761" auth="DS">
+This is covered in the RHEL6 content.
+</note>
 </notegroup>
diff --git a/RHEL6/input/system/accounts/restrictions/account_expiration.xml b/RHEL6/input/system/accounts/restrictions/account_expiration.xml
index 585b7ce..1634aa2 100644
--- a/RHEL6/input/system/accounts/restrictions/account_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/account_expiration.xml
@@ -61,4 +61,20 @@ who may have compromised their credentials.
 <ref disa="15,16,17,795"/>
 </Rule>
 
+<Rule id="account_unique_name">
+<title>All Accounts on the System Must Have Unique User or Account Names</title>
+<description>
+Change usernames, or delete accounts, so each has a unique name.
+</description>
+<ocil clause="a line is returned">
+Run the following command to check for duplicate account names:
+<pre># pwck -r</pre>
+If there are no duplicate names, no line will be returned.
+</ocil>
+<rationale>
+Unique usernames allow for accountability on the system.
+</rationale>
+<ref disa="770,804"/>
+</Rule>
+
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list