<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 12/9/13, 3:38 PM, Steinke, Leland J
      Sr CTR DISA FSO (US) wrote:<br>
    </div>
    <blockquote
cite="mid:294970648F72F5468D5C8718139CA88005ACBFE5@umechphi.easf.csd.disa.mil"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">The updates validated with OSCAP, but the verify-references.py script spat it up.  It looks good to me, otherwise.


Thanks,
Leland
--
Leland Steinke, Security+
DISA FSO Technical Support Contractor
tapestry technologies, Inc
717-267-5797 (DSN 570)
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:leland.j.steinke.ctr@mail.mil">leland.j.steinke.ctr@mail.mil</a> (gov't)
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:lsteinke@tapestrytech.com">lsteinke@tapestrytech.com</a> (com'l) 

</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-New-Rule-for-RHEL-06-000029-Lock-non-root-system-acc.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From b1043abacb74c1f87fb634e759191a30506e06e7 Mon Sep 17 00:00:00 2001
From: steinkel <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:leland.j.steinke.ctr@mail.mil">&lt;leland.j.steinke.ctr@mail.mil&gt;</a>
Date: Mon, 9 Dec 2013 15:11:27 -0500
Subject: [PATCH] New Rule for RHEL-06-000029 -- Lock non-root system accounts

---
 RHEL6/input/auxiliary/stig_overlay.xml             |    2 +-
 .../checks/locked_password_for_systemaccounts.xml  |   34 ++++++++++++++++++++
 .../system/accounts/restrictions/root_logins.xml   |   33 +++++++++++++++++++
 3 files changed, 68 insertions(+), 1 deletions(-)
 create mode 100644 RHEL6/input/checks/locked_password_for_systemaccounts.xml

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 32eb751..05075e4 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -72,7 +72,7 @@
                 &lt;VMSinfo VKey="38494" SVKey="50295" VRelease="1" /&gt;
                 &lt;title&gt;The system must prevent the root account from logging in from serial consoles.&lt;/title&gt;
         &lt;/overlay&gt;
-        &lt;overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000029" disa="366" severity="medium"&gt;
+        &lt;overlay owner="disastig" ruleid="systemaccounts_locked" ownerid="RHEL-06-000029" disa="366" severity="medium"&gt;
                 &lt;VMSinfo VKey="38496" SVKey="50297" VRelease="1" /&gt;
                 &lt;title&gt;Default system accounts, other than root, must be locked.&lt;/title&gt;
         &lt;/overlay&gt;
diff --git a/RHEL6/input/checks/locked_password_for_systemaccounts.xml b/RHEL6/input/checks/locked_password_for_systemaccounts.xml
new file mode 100644
index 0000000..e1ce5bf
--- /dev/null
+++ b/RHEL6/input/checks/locked_password_for_systemaccounts.xml
@@ -0,0 +1,34 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="locked_password_for_systemaccounts" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Locked System Accounts&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The root account is the only system account that should not be locked.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria&gt;
+      &lt;criterion comment="tests for the presence of unlocked passwords for system accounts in /etc/shadow file" test_ref="test_locked_password_for_systemaccounts" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+  &lt;ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests for the presence of unlocked passwords for system accounts in /etc/shadow file" id="test_locked_password_for_systemaccounts" version="1"&gt;
+    &lt;ind:object object_ref="object_unlocked_systemaccounts_not_root" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+  &lt;ind:textfilecontent54_object id="object_systemaccounts_not_root" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/passwd&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^(?!root)([^:]+):x:(?:0*[0-9]{1,2}|[1-4][0-9]{2}):.*$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int" operation="greater than or equal"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+  &lt;ind:textfilecontent54_object id="object_unlocked_systemaccounts_not_root" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/shadow&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match" var_ref="var_shadow_regex_systemaccounts_not_root" var_check="at least one" /&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+  &lt;local_variable comment="shadow regexes of non-root system accounts" id="var_shadow_regex_systemaccounts_not_root" version="1" datatype="string"&gt;
+    &lt;concat&gt;
+      &lt;literal_component&gt;^&lt;/literal_component&gt;
+      &lt;object_component object_ref="object_systemaccounts_not_root" item_field="subexpression" /&gt;
+      &lt;literal_component&gt;:[^!*]&lt;/literal_component&gt;
+    &lt;/concat&gt;
+  &lt;/local_variable&gt;
+&lt;/def-group&gt;
diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml
index 119931b..3a765a2 100644
--- a/RHEL6/input/system/accounts/restrictions/root_logins.xml
+++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml
@@ -167,6 +167,39 @@ become inaccessible.
 &lt;/Rule&gt;
 
 
+&lt;Rule id="systemaccounts_locked" severity="medium"&gt;
+&lt;title&gt;Ensure that System Accounts Are Locked&lt;/title&gt;
+&lt;description&gt;
+Some accounts are not associated with a human
+user of the system, and exist to perform some administrative
+function.  An attacker should not be able to log into these accounts.
+&lt;br /&gt;
+Disable login access to these accounts with the command:
+&lt;pre&gt;# passwd -l &lt;i&gt;SYSACCT&lt;/i&gt;&lt;/pre&gt;
+&lt;/description&gt;
+&lt;ocil clause="any system account (other than root) has a valid password hash"&gt;
+To obtain a listing of all users and the content of their shadow
+password field, run the command:
+&lt;pre&gt;$ awk -F: '{print $1 ":" $2}' /etc/shadow&lt;/pre&gt;
+Identify the system accounts from this listing. These will
+primarily be the accounts with UID numbers less than 500, other
+than root.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Disabling authentication for default system accounts
+makes it more difficult for attackers to make use of
+them to compromise a system.
+&lt;/rationale&gt;
+&lt;warning category="functionality"&gt;
+Do not perform the steps in this
+section on the root account. Doing so might cause the system to
+become inaccessible.
+&lt;/warning&gt;
+&lt;oval id="locked_password_for_systemaccounts" /&gt;
+&lt;ref disa="366" /&gt;
+&lt;/Rule&gt;
+
+
 &lt;Rule id="accounts_no_uid_except_zero" severity="medium"&gt;
 &lt;title&gt;Verify Only Root Has UID 0&lt;/title&gt;
 &lt;description&gt;
<div class="moz-txt-sig">-- 
1.7.1

</div></pre>
      </div>
    </blockquote>
    <br>
    It's been years since I've played with OracleDB, however when I did,
    we regularly sudo'd into the oracle account. It was *required* for
    some maintenance activities. This new rule would disable such an
    account, and place SysAdmins in a position where they'd need a DAA
    waiver to perform general system maintenance activities. This would
    also break RHN Satellite and (IIRC) JBoss. <br>
    <br>
    Could the title explicitly say "operating system" accounts, since
    this is the RHEL6 STIG? Let the application guys worry about their
    accounts as they conform to the AppServer and App STIGs.<br>
  </body>
</html>