Check: GEN000000-LNX00320
SUSE Linux Enterprise Server v11 for System z STIG:
GEN000000-LNX00320
(in versions v1 r12 through v1 r9)
Title
The system must not have special privilege accounts, such as shutdown and halt. (Cat I impact)
Discussion
If special privilege accounts are compromised, the accounts could provide privileges to execute malicious commands on a system.
Check Content
Perform the following to check for unnecessary privileged accounts: # grep "^shutdown" /etc/passwd # grep "^halt" /etc/passwd # grep "^reboot" /etc/passwd If any unnecessary privileged accounts exist this is a finding.
Fix Text
Remove any special privilege accounts, such as shutdown and halt, from the /etc/passwd and /etc/shadow files using the "userdel" or "system-config-users" commands.
Additional Identifiers
Rule ID: SV-44654r1_rule
Vulnerability ID: V-4268
Group Title: GEN000000-LNX00320
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks. |
| CCI-000764 |
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. |