Suggestion on the 'Ensure All Files Are Owned...' items
Steve Grubb
sgrubb at redhat.com
Tue Jul 23 19:30:45 UTC 2013
On Tuesday, July 23, 2013 03:10:09 PM Gary Gapinski wrote:
> On 07/23/2013 02:49 PM, Steve Grubb wrote:
> > I don't think this benchmark addressed network based user accounts.
> > I'm not even sure there is proper support in OVAL for that. If it did,
> > it would require a specific pam setup, or NIS+, or sssd. Because of
> > the variations in how to do it, I don't think there is a clear cut
> > best way to do it. So, I'd only concentrate on local users and leave
> > network users out for now.
>
> Would (not) systems which extend the authentication domain with network
> based accounts show false positives on such tests based solely on uids
> and gids from /etc/passwd and /etc/group?
Probably. But the places that you might run into this is limited, /var/spool,
/var/mail, /home, /tmp. But looking at the guide, 2.4.1.2, its clearly talking
about /etc/passwd and groups. And nowhere else do I see guidance on how to
configure remote authentication. Like I said, I don't know if OVAL can even
support remote user lookup given 3 or 4 ways to do it.
I'd also be curious if the find command gets it right.
-Steve
More information about the scap-security-guide
mailing list