<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 7/19/13 6:15 PM, Maura Dailey wrote:<br>
    </div>
    <blockquote
      cite="mid:1374272137-31362-1-git-send-email-maura@eclipse.ncsc.mil"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">Here's one more patch to clean up 'make validate' just a teensy bit more. This one required a lot of testing due to complicated regex.

- Maura Dailey

Signed-off-by: Maura Dailey <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:maura@eclipse.ncsc.mil">&lt;maura@eclipse.ncsc.mil&gt;</a>
---
 .../accounts_no_shelllogin_for_systemaccounts.xml  |   23 ++++++++++++++++++++
 .../system/accounts/restrictions/root_logins.xml   |    2 +-
 2 files changed, 24 insertions(+), 1 deletions(-)
 create mode 100644 RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml

diff --git a/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
new file mode 100644
index 0000000..a5b9334
--- /dev/null
+++ b/RHEL6/input/checks/accounts_no_shelllogin_for_systemaccounts.xml
@@ -0,0 +1,23 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="accounts_no_shelllogin_for_systemaccounts" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;System Accounts Do Not Run a Shell&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The root account is the only system account that should have a login shell.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria&gt;
+      &lt;criterion comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" test_ref="test_accounts_no_shelllogin_for_systemaccounts" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+  &lt;ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of login shells (not /sbin/nologin) for system accounts in /etc/passwd file" id="test_accounts_no_shelllogin_for_systemaccounts" version="1"&gt;
+    &lt;ind:object object_ref="object_accounts_no_shelllogin_for_systemaccounts" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+  &lt;ind:textfilecontent54_object id="object_accounts_no_shelllogin_for_systemaccounts" version="1"&gt;
+    &lt;ind:path&gt;/etc&lt;/ind:path&gt;
+    &lt;ind:filename&gt;passwd&lt;/ind:filename&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^(?!.*root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin).*$&lt;/ind:pattern&gt;</pre>
      </div>
    </blockquote>
    <br>
    Seems to fail on the sync, shutdown, halt accounts<br>
    <br>
    sync:x:5:0:sync:/sbin:/bin/sync<br>
    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown<br>
    halt:x:7:0:halt:/sbin:/sbin/halt<br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1374272137-31362-1-git-send-email-maura@eclipse.ncsc.mil"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+&lt;/def-group&gt;
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index f9b6aa2..1f2a840 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -158,7 +158,7 @@ section on the root account. Doing so might cause the system to
 become inaccessible.
 &lt;/warning&gt;
 &lt;ident cce="26966-2" /&gt;
-&lt;oval id="no_shelllogin_for_systemaccounts" /&gt;
+&lt;oval id="accounts_no_shelllogin_for_systemaccounts" /&gt;
 &lt;ref nist="" disa="178" /&gt;
 &lt;tested by="DS" on="20121024"/&gt;
 &lt;/Rule&gt;
<div class="moz-txt-sig">-- 
1.7.1

_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</div></pre>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a class="moz-txt-link-abbreviated" href="mailto:shawn@redhat.com">shawn@redhat.com</a> | 443.534.0130
@shawndwells</pre>
  </body>
</html>