Check: GEN003320
SUSE Linux Enterprise Server v11 for System z STIG:
GEN003320
(in versions v1 r12 through v1 r9)
Title
Default system accounts (with the exception of root) must not be listed in the at.allow file or must be included in the at.deny file if the at.allow file does not exist. (Cat II impact)
Discussion
Default accounts, such as bin, sys, adm, uucp, daemon, and others, should never have access to the "at" facility. This would create a possible vulnerability open to intruders or malicious users.
Check Content
# more /etc/at.allow If default accounts (such as bin, sys, adm, and others) are listed in the at.allow file, this is a finding.
Fix Text
Remove the default accounts (such as bin, sys, adm, and others traditionally UID less than 500) from the at.allow file.
Additional Identifiers
Rule ID: SV-45656r1_rule
Vulnerability ID: V-986
Group Title: GEN003320
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |