Suggestion on the 'Ensure All Files Are Owned...' items

Gary Gapinski gapinski at nasa.gov
Tue Jul 23 19:10:09 UTC 2013


On 07/23/2013 02:49 PM, Steve Grubb wrote:
> I don't think this benchmark addressed network based user accounts.
> I'm not even sure there is proper support in OVAL for that. If it did,
> it would require a specific pam setup, or NIS+, or sssd. Because of
> the variations in how to do it, I don't think there is a clear cut
> best way to do it. So, I'd only concentrate on local users and leave
> network users out for now.

Would (not) systems which extend the authentication domain with network
based accounts show false positives on such tests based solely on uids
and gids from /etc/passwd and /etc/group?



More information about the scap-security-guide mailing list