Check: SOL-11.1-040200
Solaris 11 x86 STIG:
SOL-11.1-040200
(in versions v2 r10 through v1 r10)
Title
The system must restrict the ability of users to assume excessive privileges to members of a defined group and prevent unauthorized users from accessing administrative tools. (Cat II impact)
Discussion
Allowing any user to elevate their privileges can allow them excessive control of the system tools.
Check Content
Verify the root user is configured as a role, rather than a normal user. # userattr type root If the command does not return the word "role", this is a finding. Verify at least one local user has been assigned the root role. # grep '[:;]roles=root[^;]*' /etc/user_attr If no lines are returned, or no users are permitted to assume the root role, this is a finding.
Fix Text
The root role is required. Convert the root user into a role. # usermod -K type=role root Add the root role to authorized users' logins. # usermod -R +root [username] Remove the root role from users who should not be authorized to assume it. # usermod -R -root [username]
Additional Identifiers
Rule ID: SV-220001r854560_rule
Vulnerability ID: V-220001
Group Title: SRG-OS-000324
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000345 |
The organization enforces logical access restrictions associated with changes to the information system. |
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |