Cron and faillog/lastlog

Josh Kayse Joshua.Kayse at gtri.gatech.edu
Mon Jan 27 17:38:33 UTC 2014


Per the RHEL6 Guide I have configured my system to utilize faillock and 
lastlog.  Now I have found that cron no longer works.

I have tracked it down to being an SELinux problem.  crond_t is trying 
to read/write lastlog_t and faillog_t files.  Has anyone else run in to 
this problem or have recommendations?

My findings so far have shown that cron requires auth, account, and 
session from password-auth.  Inside password-auth we have the 
appropriate faillock/lastlog lines in auth/account/session.

Previously we have put the faillock/lastlog lines in the individual 
services that users can use to access the system (gdm, sshd, login, etc) 
but this was not compliant with the SSG/STIG.

Should we go back to placing these lines in the individual services or 
grant the permission to crond_t?  Could this be because we disable the 
unconfined domain?

Thanks,
-josh

-- 
404.407.6630

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5059 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140127/3d132b1d/attachment.p7s>


More information about the scap-security-guide mailing list