STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Default operating system accounts, other than root, must be locked.

DISA Rule

SV-208806r603263_rule

Vulnerability Number

V-208806

Group Title

SRG-OS-000480

Rule Version

OL6-00-000029

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Some accounts are not associated with a human user of the system, and exist to perform some administrative function. An attacker should not be able to log into these accounts.

Disable logon access to these accounts with the command:

# passwd -l [SYSACCT]

Check Contents

To obtain a listing of all users and the contents of their shadow password field, run the command:

$ awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow

Identify the operating system accounts from this listing. These will primarily be the accounts with UID numbers less than 500, other than root. If any default operating system account (other than root) has a valid password hash, this is a finding.

Vulnerability Number

V-208806

Documentable

False

Rule Version

OL6-00-000029

Severity Override Guidance

To obtain a listing of all users and the contents of their shadow password field, run the command:

$ awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow

Identify the operating system accounts from this listing. These will primarily be the accounts with UID numbers less than 500, other than root. If any default operating system account (other than root) has a valid password hash, this is a finding.

Check Content Reference

M

Target Key

2928

Comments