[PATCH] Adding new OVAL check that will parse /etc/passwd, looking for system accounts with real login shells (not /sbin/nologin).

Steve Grubb sgrubb at redhat.com
Mon Jul 22 17:53:20 UTC 2013


On Monday, July 22, 2013 12:00:13 PM Maura Dailey wrote:
> I can add more exceptions. I'm more concerned that the prose is so vague.
>
> > Seems to fail on the sync, shutdown, halt accounts
> > 
> > sync:x:5:0:sync:/sbin:/bin/sync
> > shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
> > halt:x:7:0:halt:/sbin:/sbin/halt

This dates back to the 1980's. Back then, sudo didn't exist. So, to let non-
admins do something "safe" they added these system accounts and set the shell 
to the admin action. So, if you needed to sync the disks, you just logged in 
under the sync account. To power off, you just logged in under shutdown.

These are no longer used as they once were. But they are there simply for 
historical reasons. The accounts could have their shell removed. But if a 
check is made, then you'd want to check that account name matches the program 
name before deciding it OK due to white list to prevent other shells from 
being substituted.

Looking at the prose:

>> +      <description>The root account is the only system account that should 
have a login shell.</description>

I also think this is a problem. Its typical to login as the postgres or oracle 
user to perform admin tasks for that service.

-Steve

>> +    </metadata>
>> +    <criteria>
>> +      <criterion comment="tests for the presence of login shells (not 
/sbin/nologin) for system accounts in /etc/passwd file" 
test_ref="test_accounts_no_shelllogin_for_systemaccounts" />




More information about the scap-security-guide mailing list