STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must separate user functionality (including user interface services) from information system management functionality.

DISA Rule

SV-257545r1208204_rule

Vulnerability Number

V-257545

Group Title

SRG-APP-000211-CTR-000530

Rule Version

CNTR-OS-000500

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

Disable and remove passwords from root and core accounts by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'usermod -p '*' root; usermod -p '*' core' 2>/dev/null; done

Remove any additional user accounts from the nodes by executing the following:
oc debug node/<node> -- chroot /host /bin/bash -c 'userdel <user>'

Where OpenShift Virtualization is enabled:
oc get rolebinding -ojson | jq -r '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate")) | .metadata.name' | xargs oc delete rolebinding

Check Contents

Verify root and core are the only user accounts on the nodes by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; cat /etc/passwd' 2>/dev/null; done

The output will look similar to:
<node_name> root:x:0:0:root:/root:/bin/bash
core:x:1000:1000:CoreOS Admin:/var/home/core:/bin/bash
containers:x:993:995:User for housing the sub ID range for containers:/var/home/containers:/sbin/nologin

If there are any user accounts in addition to root, containers, and core, this is a finding.

Verify the root and core users are set to disable password logon by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; grep -e '^root' -e '^core' /etc/shadow' 2>/dev/null; done

The output will look similar to:
<node_name>
root:*:18367:0:99999:7:::
core:*:18939:0:99999:7:::

If the password entry has anything other than '*', this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get rolebinding -ojson | jq -c '.items[] | select(.roleRef.name
| contains("token.kubevirt.io:generate"))'

If these results show users with this rolebinding, this is a finding.

Vulnerability Number

V-257545

Documentable

False

Rule Version

CNTR-OS-000500

Severity Override Guidance

Verify root and core are the only user accounts on the nodes by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; cat /etc/passwd' 2>/dev/null; done

The output will look similar to:
<node_name> root:x:0:0:root:/root:/bin/bash
core:x:1000:1000:CoreOS Admin:/var/home/core:/bin/bash
containers:x:993:995:User for housing the sub ID range for containers:/var/home/containers:/sbin/nologin

If there are any user accounts in addition to root, containers, and core, this is a finding.

Verify the root and core users are set to disable password logon by executing the following:
for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n '$HOSTNAME '; grep -e '^root' -e '^core' /etc/shadow' 2>/dev/null; done

The output will look similar to:
<node_name>
root:*:18367:0:99999:7:::
core:*:18939:0:99999:7:::

If the password entry has anything other than '*', this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get rolebinding -ojson | jq -c '.items[] | select(.roleRef.name
| contains("token.kubevirt.io:generate"))'

If these results show users with this rolebinding, this is a finding.

Check Content Reference

M

Target Key

5547