[PATCH] Adding new OVAL check that will parse /etc/passwd, looking for system accounts with real login shells (not /sbin/nologin).

Shawn Wells shawn at redhat.com
Wed Jul 31 18:06:40 UTC 2013


On 7/22/13 4:43 PM, Maura Dailey wrote:
>
> +    <ind:pattern operation="pattern 
> match">^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>

Is this still outstanding?

My original thinking was that only the 'halt' user should have 
/sbin/halt as an acceptable shell, only 'shutdown' should have 
/sbin/shutdown, etc, however the security gains for this seem incredibly 
trivial.

This is a marked improvement. If someone has a strong enough opinion on 
only having /sbin/halt assigned to halt, patches welcome :)

Ack from me.


More information about the scap-security-guide mailing list