[PATCH 1/9] OVAL signoff for accounts_no_shelllogin_for_systemaccounts OVAL signoff: accounts_no_shelllogin_for_systemaccounts

Shawn Wells swells at redhat.com
Wed Sep 18 21:05:35 UTC 2013


Pushed

-----
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

On Sep 18, 2013, at 4:42 PM, David Smith <dsmith at eclipse.ncsc.mil> wrote:

> ack x9 -- please push
> 
> On 09/18/2013 04:38 PM, shawn at redhat.com wrote:
>> From: Shawn Wells <shawn at redhat.com>
>> 
>> TESTING:
>> [user at redhat-thing-1 checks]$ grep ftp /etc/passwd
>> ftp:x:14:50:FTP User:/var/ftp:/bin/bash
>> [user at redhat-thing-1 checks]$ ./testcheck.py accounts_no_shelllogin_for_systemaccounts.xml
>> Evaluating with OVAL tempfile : /tmp/accounts_no_shelllogin_for_systemaccountszRaZw9.xml
>> Writing results to : /tmp/accounts_no_shelllogin_for_systemaccountszRaZw9.xml-results
>> Definition oval:scap-security-guide.testing:def:104: false
>> Evaluation done.
>> [user at redhat-thing-1 checks]$ grep ftp /etc/passwd
>> ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
>> [user at redhat-thing-1 checks]$ ./testcheck.py accounts_no_shelllogin_for_systemaccounts.xml
>> Evaluating with OVAL tempfile : /tmp/accounts_no_shelllogin_for_systemaccountsn0AVoG.xml
>> Writing results to : /tmp/accounts_no_shelllogin_for_systemaccountsn0AVoG.xml-results
>> Definition oval:scap-security-guide.testing:def:104: true
>> Evaluation done.
>> [user at redhat-thing-1 checks]$ vim accounts_no_shelllogin_for_systemaccounts.xml
>> [user at redhat-thing-1 checks]$ ./testcheck.py accounts_no_shelllogin_for_systemaccounts.xml
>> Evaluating with OVAL tempfile : /tmp/accounts_no_shelllogin_for_systemaccountsiUXzmf.xml
>> Writing results to : /tmp/accounts_no_shelllogin_for_systemaccountsiUXzmf.xml-results
>> Definition oval:scap-security-guide.testing:def:104: true
>> Evaluation done.
>> ---
>>  .../accounts_no_shelllogin_for_systemaccounts.xml  |    4 ++--
>>  1 files changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
>> index 966f75b..ff17b6e 100644
>> --- a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
>> +++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
>> @@ -6,6 +6,7 @@
>>          <platform>Red Hat Enterprise Linux 6</platform>
>>        </affected>
>>        <description>The root account is the only system account that should have a login shell.</description>
>> +      <reference source="swells" ref_id="20130918" ref_url="test_attestation" />
>>      </metadata>
>>      <criteria>
>>        <criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" />
>> @@ -15,8 +16,7 @@
>>      <ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" />
>>    </ind:textfilecontent54_test>
>>    <ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1">
>> -    <ind:path>/etc</ind:path>
>> -    <ind:filename>passwd</ind:filename>
>> +    <ind:filepath>/etc/passwd</ind:filepath>
>>      <ind:pattern operation="pattern match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
>>      <ind:instance datatype="int">1</ind:instance>
>>    </ind:textfilecontent54_object>
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list