Suggestion on the 'Ensure All Files Are Owned...' items

Steve Grubb sgrubb at redhat.com
Tue Jul 23 19:30:45 UTC 2013


On Tuesday, July 23, 2013 03:10:09 PM Gary Gapinski wrote:
> On 07/23/2013 02:49 PM, Steve Grubb wrote:
> > I don't think this benchmark addressed network based user accounts.
> > I'm not even sure there is proper support in OVAL for that. If it did,
> > it would require a specific pam setup, or NIS+, or sssd. Because of
> > the variations in how to do it, I don't think there is a clear cut
> > best way to do it. So, I'd only concentrate on local users and leave
> > network users out for now.
> 
> Would (not) systems which extend the authentication domain with network
> based accounts show false positives on such tests based solely on uids
> and gids from /etc/passwd and /etc/group?

Probably. But the places that you might run into this is limited, /var/spool, 
/var/mail, /home, /tmp. But looking at the guide, 2.4.1.2, its clearly talking 
about /etc/passwd and groups. And nowhere else do I see guidance on how to 
configure remote authentication. Like I said, I don't know if OVAL can even 
support remote user lookup given 3 or 4 ways to do it. 

I'd also be curious if the find command gets it right.

-Steve


More information about the scap-security-guide mailing list