<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/9/13, 6:17 PM, Steinke, Leland J
Sr CTR DISA FSO (US) wrote:<br>
</div>
<blockquote
cite="mid:294970648F72F5468D5C8718139CA88005ACC178@umechphi.easf.csd.disa.mil"
type="cite">
<pre wrap="">Hi Shawn,
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">> </span>Could the title explicitly say "operating system" accounts, since this
<span class="moz-txt-citetags">> </span>is the RHEL6 STIG? Let the application guys worry about their accounts
<span class="moz-txt-citetags">> </span>as they conform to the AppServer and App STIGs.
</pre>
</blockquote>
<pre wrap="">Done. The proposed patch is in the attached file.
</pre>
</blockquote>
<br>
Had a chance to read this closer. What's the reason for inclusion?
This would step beyond the baseline of even USGCB.<br>
<br>
RHEL5 CCE-3987-5:<br>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<table style="border-collapse: collapse;width:855pt" border="0"
cellpadding="0" cellspacing="0" width="855">
<colgroup><col
style="mso-width-source:userset;mso-width-alt:3584;width:84pt"
width="84"> <col
style="mso-width-source:userset;mso-width-alt:11520;width:270pt"
width="270"> <col
style="mso-width-source:userset;mso-width-alt:4992;width:117pt"
width="117"> <col
style="mso-width-source:userset;mso-width-alt:5034;width:118pt"
width="118"> <col
style="mso-width-source:userset;mso-width-alt:11349;width:266pt"
width="266"> </colgroup><tbody>
<tr style="height:85.0pt" height="85">
<!--StartFragment--> <td class="xl71"
style="height:85.0pt;width:84pt;font-size:
10.0pt;color:windowtext;font-weight:400;text-decoration:none;text-underline-style:
none;text-line-through:none;font-family:Arial;border:none;background:#D9D9D9;
mso-pattern:#D9D9D9 none" height="85" width="84">CCE-3987-5</td>
<td class="xl71"
style="width:270pt;font-size:10.0pt;color:windowtext;
font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:
none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
none" width="270">Login access to non-root system accounts
should be enabled or disabled as appropriate<span
style="mso-spacerun:yes"> </span></td>
<td class="xl72"
style="width:117pt;font-size:10.0pt;color:windowtext;
font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:
none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
none" width="117">disabled</td>
<td class="xl71"
style="width:118pt;font-size:10.0pt;color:windowtext;
font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:
none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
none" width="118"><span style="mso-spacerun:yes"> </span>via
/etc/passwd</td>
<td class="xl71"
style="width:266pt;font-size:10.0pt;color:windowtext;
font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:
none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
none" width="266">List all users, their UIDs, and their
shells by running:<br>
# awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd<br>
For each identified system account SYSACCT , lock the
account:<br>
# usermod -L SYSACCT<br>
and disable its shell:<br>
# usermod -s /sbin/nologin SYSACCT</td>
<!--EndFragment--> </tr>
</tbody>
</table>
<meta name="ProgId" content="Excel.Sheet">
<meta name="Generator" content="Microsoft Excel 14">
<link id="Main-File" rel="Main-File"
href="file://localhost/Users/shawnwells/Library/Caches/TemporaryItems/msoclip/0/clip.htm">
<link rel="File-List"
href="file://localhost/Users/shawnwells/Library/Caches/TemporaryItems/msoclip/0/clip_filelist.xml">
<style>
<!--table
        {mso-displayed-decimal-separator:"\.";
        mso-displayed-thousand-separator:"\,";}
@page
        {margin:.75in .7in .75in .7in;
        mso-header-margin:.3in;
        mso-footer-margin:.3in;
        mso-page-orientation:landscape;}
td
        {padding-top:1px;
        padding-right:1px;
        padding-left:1px;
        mso-ignore:padding;
        color:black;
        font-size:11.0pt;
        font-weight:400;
        font-style:normal;
        text-decoration:none;
        font-family:Calibri, sans-serif;
        mso-font-charset:0;
        mso-number-format:General;
        text-align:general;
        vertical-align:bottom;
        border:none;
        mso-background-source:auto;
        mso-pattern:auto;
        mso-protection:locked visible;
        white-space:nowrap;
        mso-rotate:0;}
.xl71
        {color:windowtext;
        font-size:10.0pt;
        font-family:Arial, sans-serif;
        mso-font-charset:0;
        white-space:normal;}
.xl72
        {color:windowtext;
        font-size:10.0pt;
        font-family:Arial, sans-serif;
        mso-font-charset:0;
        text-align:left;
        white-space:normal;}
.xl73
        {font-size:10.0pt;}
-->
</style><br>
<br>
Maps to RHEL6 CCE-26966-2:<br>
<blockquote type="cite">
<meta charset="utf-8">
<a name="no_shelllogin_for_systemaccounts" style="color: rgb(0, 0,
0); font-family: Times; font-size: medium; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing:
normal; line-height: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: auto; word-spacing: 0px; -webkit-text-stroke-width:
0px;">
<div class="rule" style="margin-top: 1em; margin-bottom: 1em;
margin-left: 117.765625px; border: 1px solid;
background-color: rgb(204, 204, 204); padding: 10px;
background-position: initial initial; background-repeat:
initial initial;">Some accounts are not associated with a
human user of the system, and exist to perform some
administrative function. Should an attacker be able to log
into these accounts, they should not be granted access to a
shell.<span class="Apple-converted-space"> </span><br xmlns="">
<br xmlns="">
The login shell for each local account is stored in the last
field of each line in<span class="Apple-converted-space"> </span><code
xmlns="">/etc/passwd</code>. System accounts are those user
accounts with a user ID less than 500. The user ID is stored
in the third field. If any system account<span
class="Apple-converted-space"> </span><i xmlns="">SYSACCT</i><span
class="Apple-converted-space"> </span>(other than root) has
a login shell, disable it with the command:
<pre xmlns="" style="margin-bottom: 0.5em; margin-top: 0.25em; margin-left: 31.125px; font-family: monospace; font-size: 12px;"># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
</div>
</a></blockquote>
<br>
</body>
</html>