SSG 0.1-14-14 - no_uidzero_except_root

ssg fthfth ssgtesting1 at yahoo.com
Fri Feb 14 19:15:43 UTC 2014


For Verify Only Root Has UID 0 - (CCE-26971-2), with either the stig-rhel6-server or the usgcb-rhel6-server profiles selected from the SCAP stream, when run with SCC 3.1.1.1, may produce a false-negative when running SCC 3.1.1.1 on a RHEL6V1R2 non-complaint machine.
$ /usr/bin/id -u root && /usr/bin/id -u root2
0
0
$/usr/bin/awk -F: '($3 == "0") {print}' /etc/passwd
root:...:0:0:root:/root:/bin/bash
root2:...:0:0::/home/root2:/bin/bash
The regex matches root vice uid 0:^[^r][^o][^o][^t].*:0
See the following report output:
Verify Only Root Has UID 0
ID:  no_uidzero_except_root
Result:  Pass
Identities:  CCE-26971-2
Description:  If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.
Fix Text:   
Severity:  medium
Weight:   
Reference:  AC-6
IA-2(1)
366
Definitions:  
ID:  oval:ssg:def:273
Result:  true
Title:  UID 0 Belongs Only To Root
Description:  Only the root account should be assigned a user id of 0.
Class:  compliance
Tests:  

    true (All item-state comparisons must be true.)
        true (tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file)

Tests:  
Test ID:  oval:ssg:tst:274
Result:  true
Title:  tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file
Check Existence:  No collected items may exist.
Check:  Result is based on check existence only.
State Operator:  All item-state comparisons must be true.
Object ID:  oval:ssg:obj:1384
Object Requirements:  

    path must be equal to '/etc'
    filename must be equal to 'passwd'
    pattern must match the pattern '^(?!root:)[^:]*:[^:]:0'
    instance must be equal to '1'



More information about the scap-security-guide mailing list