Check: GEN000980
Title
The system must prevent the root account from directly logging in except from the system console. (Cat II impact)
Discussion
Limiting the root account direct logins to only system consoles protects the root account from direct unauthorized access from a non-console device.
Check Content
Check the CONSOLE setting in /etc/default/login # grep CONSOLE /etc/default/login If CONSOLE is set to a value other than /dev/console, this is a finding.
Fix Text
Edit the /etc/default/login file and uncomment the line containing /dev/console if it is commented out.
Additional Identifiers
Rule ID:
Vulnerability ID: V-778
Group Title:
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-000770 |
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| IA-2 (5) |
Group Authentication |