[PATCH 29/64] Mapped IA-2 against no_uidzero_except_root sshd_disable_root_login and new no_direct_root_logins

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:10:33 UTC 2013


-------------- next part --------------
>From 4881f094da76e14a31124de5cb8f41c83f60d6d8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 18:59:36 -0400
Subject: [PATCH 29/64] Mapped IA-2 against no_uidzero_except_root  sshd_disable_root_login and new  no_direct_root_logins
 - IA-2 against no_uidzero_except_root to ensure no other accounts have priv access
 - IA-2(1) against sshd_disable_root_login to ensure users do not remote into the machine directly as root
 - New no_direct_root_logins to ensure users first login as nonpriv account and escalate to root

---
 RHEL6/input/services/ssh.xml                       |    2 +-
 .../system/accounts/restrictions/root_logins.xml   |   35 +++++++++++++++++++-
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 40cad5a..d9de675 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -265,7 +265,7 @@ and also allows direct attack attempts on root's password.
 </rationale>
 <ident cce="27100-7" />
 <oval id="sshd_permitrootlogin_no" />
-<ref nist="AC-6(2)" disa="770" />
+<ref nist="AC-6(2),IA-2(1)" disa="770" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index dd0e9ef..e855d8e 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -35,6 +35,39 @@ console interface may be retained for backwards compatibility:
 <pre>vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 ...</pre></li>
 </ul>
 -->
+<Rule id="no_direct_root_logins" severity="medium">
+<title>Direct root Logins Not Allowed</title>
+<description>To further limit access to the <tt>root</tt> account, administrators
+can disable root logins at the console by editing the <tt>/etc/secuetty</tt> file. 
+This file lists all devices the root user is allowed to login to. If the file does
+not exist at all, the root user can login through any communication device on thesyste,
+whether via the console or a raw network interface. This is dangerous as as user can login to
+his machine as root via Telnet, which sends the passowrd in plain text over the network.
+By default, Red Hat Enteprise Linux's <tt>/etc/securetty</tt> file only allows the root user
+to login at the console physically attached to the machine. To prevent root from logging in,
+remove the contents of this file. To prevent direct root logins, remove the contents of this
+file by typing the following command:
+<pre>
+echo > /etc/securetty
+</pre>
+<ocil clause="the /etc/securetty file is not empty">
+To ensure root may not directly login to the system over physical consoles,
+run the following command:
+<pre>cat /etc/securetty</pre>
+If any output is returned, this is a finding.
+</ocil>
+<rationale>
+Disabling direct root logins ensures proper accountability and multifactor
+authentication to privileged accounts. Users will first login, then escalate
+to privileged (root) access via su/sudo. This is required for FISMA Low
+and FISMA Moderate systems.
+</rationale>
+<ident cce="TODO" />
+<oval id="TODO" />
+<ref nist="IA-2(1)" />
+<tested by="DS" on="20121024"/>
+</Rule>
+
 <Rule id="restrict_root_console_logins" severity="medium">
 <title>Restrict Virtual Console Root Logins</title>
 <description>
@@ -167,7 +200,7 @@ access to root privileges in an accountable manner.
 </rationale>
 <ident cce="26971-2" />
 <oval id="accounts_no_uid_except_zero" />
-<ref nist="AC-6" disa="366" />
+<ref nist="AC-6,IA-2(1)" disa="366" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-- 
1.7.1



More information about the scap-security-guide mailing list