[PATCH] Adding new OVAL check that will parse /etc/passwd, looking for system accounts with real login shells (not /sbin/nologin).
Shawn Wells
shawn at redhat.com
Wed Jul 31 18:06:40 UTC 2013
On 7/22/13 4:43 PM, Maura Dailey wrote:
>
> + <ind:pattern operation="pattern
> match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
Is this still outstanding?
My original thinking was that only the 'halt' user should have
/sbin/halt as an acceptable shell, only 'shutdown' should have
/sbin/shutdown, etc, however the security gains for this seem incredibly
trivial.
This is a marked improvement. If someone has a strong enough opinion on
only having /sbin/halt assigned to halt, patches welcome :)
Ack from me.
More information about the scap-security-guide
mailing list