<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 12/9/13, 6:17 PM, Steinke, Leland J
      Sr CTR DISA FSO (US) wrote:<br>
    </div>
    <blockquote
cite="mid:294970648F72F5468D5C8718139CA88005ACC178@umechphi.easf.csd.disa.mil"
      type="cite">
      <pre wrap="">Hi Shawn,

</pre>
      <blockquote type="cite" style="color: #000000;">
        <pre wrap=""><span class="moz-txt-citetags">&gt; </span>Could the title explicitly say "operating system" accounts, since this
<span class="moz-txt-citetags">&gt; </span>is the RHEL6 STIG? Let the application guys worry about their accounts
<span class="moz-txt-citetags">&gt; </span>as they conform to the AppServer and App STIGs.
</pre>
      </blockquote>
      <pre wrap="">Done.  The proposed patch is in the attached file.
</pre>
    </blockquote>
    <br>
    Had a chance to read this closer. What's the reason for inclusion?
    This would step beyond the baseline of even USGCB.<br>
    <br>
    RHEL5 CCE-3987-5:<br>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <table style="border-collapse: collapse;width:855pt" border="0"
      cellpadding="0" cellspacing="0" width="855">
      <colgroup><col
          style="mso-width-source:userset;mso-width-alt:3584;width:84pt"
          width="84"> <col
          style="mso-width-source:userset;mso-width-alt:11520;width:270pt"
          width="270"> <col
          style="mso-width-source:userset;mso-width-alt:4992;width:117pt"
          width="117"> <col
          style="mso-width-source:userset;mso-width-alt:5034;width:118pt"
          width="118"> <col
          style="mso-width-source:userset;mso-width-alt:11349;width:266pt"
          width="266"> </colgroup><tbody>
        <tr style="height:85.0pt" height="85">
          <!--StartFragment--> <td class="xl71"
            style="height:85.0pt;width:84pt;font-size:
            10.0pt;color:windowtext;font-weight:400;text-decoration:none;text-underline-style:

            none;text-line-through:none;font-family:Arial;border:none;background:#D9D9D9;

            mso-pattern:#D9D9D9 none" height="85" width="84">CCE-3987-5</td>
          <td class="xl71"
            style="width:270pt;font-size:10.0pt;color:windowtext;
            font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:

            none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
            none" width="270">Login access to non-root system accounts
            should be enabled or disabled as appropriate<span
              style="mso-spacerun:yes"> </span></td>
          <td class="xl72"
            style="width:117pt;font-size:10.0pt;color:windowtext;
            font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:

            none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
            none" width="117">disabled</td>
          <td class="xl71"
            style="width:118pt;font-size:10.0pt;color:windowtext;
            font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:

            none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
            none" width="118"><span style="mso-spacerun:yes"> </span>via
            /etc/passwd</td>
          <td class="xl71"
            style="width:266pt;font-size:10.0pt;color:windowtext;
            font-weight:400;text-decoration:none;text-underline-style:none;text-line-through:

            none;font-family:Arial;border:none;background:#D9D9D9;mso-pattern:#D9D9D9
            none" width="266">List all users, their UIDs, and their
            shells by running:<br>
            # awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd<br>
            For each identified system account SYSACCT , lock the
            account:<br>
            # usermod -L SYSACCT<br>
            and disable its shell:<br>
            # usermod -s /sbin/nologin SYSACCT</td>
          <!--EndFragment--> </tr>
      </tbody>
    </table>
    <meta name="ProgId" content="Excel.Sheet">
    <meta name="Generator" content="Microsoft Excel 14">
    <link id="Main-File" rel="Main-File"
href="file://localhost/Users/shawnwells/Library/Caches/TemporaryItems/msoclip/0/clip.htm">
    <link rel="File-List"
href="file://localhost/Users/shawnwells/Library/Caches/TemporaryItems/msoclip/0/clip_filelist.xml">
    <style>
<!--table
        {mso-displayed-decimal-separator:"\.";
        mso-displayed-thousand-separator:"\,";}
@page
        {margin:.75in .7in .75in .7in;
        mso-header-margin:.3in;
        mso-footer-margin:.3in;
        mso-page-orientation:landscape;}
td
        {padding-top:1px;
        padding-right:1px;
        padding-left:1px;
        mso-ignore:padding;
        color:black;
        font-size:11.0pt;
        font-weight:400;
        font-style:normal;
        text-decoration:none;
        font-family:Calibri, sans-serif;
        mso-font-charset:0;
        mso-number-format:General;
        text-align:general;
        vertical-align:bottom;
        border:none;
        mso-background-source:auto;
        mso-pattern:auto;
        mso-protection:locked visible;
        white-space:nowrap;
        mso-rotate:0;}
.xl71
        {color:windowtext;
        font-size:10.0pt;
        font-family:Arial, sans-serif;
        mso-font-charset:0;
        white-space:normal;}
.xl72
        {color:windowtext;
        font-size:10.0pt;
        font-family:Arial, sans-serif;
        mso-font-charset:0;
        text-align:left;
        white-space:normal;}
.xl73
        {font-size:10.0pt;}
-->
</style><br>
    <br>
    Maps to RHEL6 CCE-26966-2:<br>
    <blockquote type="cite">
      <meta charset="utf-8">
      <a name="no_shelllogin_for_systemaccounts" style="color: rgb(0, 0,
        0); font-family: Times; font-size: medium; font-style: normal;
        font-variant: normal; font-weight: normal; letter-spacing:
        normal; line-height: normal; orphans: auto; text-align: start;
        text-indent: 0px; text-transform: none; white-space: normal;
        widows: auto; word-spacing: 0px; -webkit-text-stroke-width:
        0px;">
        <div class="rule" style="margin-top: 1em; margin-bottom: 1em;
          margin-left: 117.765625px; border: 1px solid;
          background-color: rgb(204, 204, 204); padding: 10px;
          background-position: initial initial; background-repeat:
          initial initial;">Some accounts are not associated with a
          human user of the system, and exist to perform some
          administrative function. Should an attacker be able to log
          into these accounts, they should not be granted access to a
          shell.<span class="Apple-converted-space"> </span><br xmlns="">
          <br xmlns="">
          The login shell for each local account is stored in the last
          field of each line in<span class="Apple-converted-space"> </span><code
            xmlns="">/etc/passwd</code>. System accounts are those user
          accounts with a user ID less than 500. The user ID is stored
          in the third field. If any system account<span
            class="Apple-converted-space"> </span><i xmlns="">SYSACCT</i><span
            class="Apple-converted-space"> </span>(other than root) has
          a login shell, disable it with the command:
          <pre xmlns="" style="margin-bottom: 0.5em; margin-top: 0.25em; margin-left: 31.125px; font-family: monospace; font-size: 12px;"># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
        </div>
      </a></blockquote>
    <br>
  </body>
</html>