Title

The root account must not be used for direct logins. (Cat II impact)

Discussion

Direct login with the root account prevents individual user accountability. Acceptable non-routine uses of the root account for direct login are limited to emergency maintenance, the use of single-user mode for maintenance, and situations where individual administrator accounts are not available.

Check Content

Check if the root is used for direct logins. Procedure: # last root | grep -v reboot If the last command is not available, consult vendor documentation to determine an appropriate method for obtaining a list of root account logins. If any direct login records for root are listed, this is a finding.

Fix Text

Enforce policy requiring all root account access is attained by first logging into a user account and then becoming root (using su, for example).

Additional Identifiers

Rule ID: SV-12480r2_rule

Vulnerability ID: V-11979

Group Title: GEN001020

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.