|
 |
9be3b2 |
From eed29b1db9dd62d014842340abb8601570fe6655 Mon Sep 17 00:00:00 2001
|
|
|
9be3b2 |
From: Carlos Matos <cmatos@redhat.com>
|
|
|
9be3b2 |
Date: Thu, 22 Jul 2021 14:26:49 -0400
|
|
|
9be3b2 |
Subject: [PATCH] New rule for RHEL-08-020270
|
|
|
9be3b2 |
|
|
|
9be3b2 |
---
|
|
|
9be3b2 |
.../account_emergency_expire_date/rule.yml | 52 +++++++++++++++++++
|
|
|
9be3b2 |
products/rhel8/profiles/stig.profile | 1 +
|
|
|
9be3b2 |
shared/references/cce-redhat-avail.txt | 1 -
|
|
|
9be3b2 |
.../data/profile_stability/rhel8/stig.profile | 1 +
|
|
|
9be3b2 |
.../profile_stability/rhel8/stig_gui.profile | 1 +
|
|
|
9be3b2 |
5 files changed, 55 insertions(+), 1 deletion(-)
|
|
|
9be3b2 |
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
|
|
|
9be3b2 |
|
|
|
9be3b2 |
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
|
|
|
9be3b2 |
new file mode 100644
|
|
|
9be3b2 |
index 0000000000..a47c7f39bc
|
|
|
9be3b2 |
--- /dev/null
|
|
|
9be3b2 |
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml
|
|
|
9be3b2 |
@@ -0,0 +1,52 @@
|
|
|
9be3b2 |
+documentation_complete: true
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+prodtype: fedora,rhel8
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+title: 'Assign Expiration Date to Emergency Accounts'
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+description: |-
|
|
|
9be3b2 |
+ Emergency accounts are privileged accounts established in response to
|
|
|
9be3b2 |
+ crisis situations where the need for rapid account activation is required.
|
|
|
9be3b2 |
+ In the event emergency accounts are required, configure the system to
|
|
|
9be3b2 |
+ terminate them after a documented time period. For every emergency account,
|
|
|
9be3b2 |
+ run the following command to set an expiration date on it, substituting
|
|
|
9be3b2 |
+ <tt>ACCOUNT_NAME</tt> and <tt>YYYY-MM-DD</tt>
|
|
|
9be3b2 |
+ appropriately:
|
|
|
9be3b2 |
+ $ sudo chage -E YYYY-MM-DD ACCOUNT_NAME
|
|
|
9be3b2 |
+ <tt>YYYY-MM-DD</tt> indicates the documented expiration date for the
|
|
|
9be3b2 |
+ account. For U.S. Government systems, the operating system must be
|
|
|
9be3b2 |
+ configured to automatically terminate these types of accounts after a
|
|
|
9be3b2 |
+ period of 72 hours.
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+rationale: |-
|
|
|
9be3b2 |
+ If emergency user accounts remain active when no longer needed or for
|
|
|
9be3b2 |
+ an excessive period, these accounts may be used to gain unauthorized access.
|
|
|
9be3b2 |
+ To mitigate this risk, automated termination of all emergency accounts
|
|
|
9be3b2 |
+ must be set upon account creation.
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+severity: medium
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+identifiers:
|
|
|
9be3b2 |
+ cce@rhel8: CCE-85910-8
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+references:
|
|
|
9be3b2 |
+ cis-csc: 1,12,13,14,15,16,18,3,5,7,8
|
|
|
9be3b2 |
+ cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS06.03
|
|
|
9be3b2 |
+ disa: CCI-000016,CCI-001682
|
|
|
9be3b2 |
+ isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4
|
|
|
9be3b2 |
+ isa-62443-2013: 'SR 1.1,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 6.2'
|
|
|
9be3b2 |
+ iso27001-2013: A.12.4.1,A.12.4.3,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
|
|
|
9be3b2 |
+ nist: AC-2(2),AC-2(3),CM-6(a)
|
|
|
9be3b2 |
+ nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6
|
|
|
9be3b2 |
+ srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002
|
|
|
9be3b2 |
+ stigid@rhel8: RHEL-08-020270
|
|
|
9be3b2 |
+ vmmsrg: SRG-OS-000002-VMM-000020,SRG-OS-000123-VMM-000620
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+ocil_clause: 'any emergency accounts have no expiration date set or do not expire within a documented time frame'
|
|
|
9be3b2 |
+
|
|
|
9be3b2 |
+ocil: |-
|
|
|
9be3b2 |
+ For every emergency account, run the following command
|
|
|
9be3b2 |
+ to obtain its account aging and expiration information:
|
|
|
9be3b2 |
+ $ sudo chage -l ACCOUNT_NAME
|
|
|
9be3b2 |
+ Verify each of these accounts has an expiration date set as documented.
|
|
|
9be3b2 |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
9be3b2 |
index 7270a8f91f..c4b9d02af5 100644
|
|
|
9be3b2 |
--- a/products/rhel8/profiles/stig.profile
|
|
|
9be3b2 |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
9be3b2 |
@@ -558,6 +558,7 @@ selections:
|
|
|
9be3b2 |
- account_disable_post_pw_expiration
|
|
|
9be3b2 |
|
|
|
9be3b2 |
# RHEL-08-020270
|
|
|
9be3b2 |
+ - account_emergency_expire_date
|
|
|
9be3b2 |
|
|
|
9be3b2 |
# RHEL-08-020280
|
|
|
9be3b2 |
- accounts_password_pam_ocredit
|
|
|
9be3b2 |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
9be3b2 |
index 665f903ead..f500179292 100644
|
|
|
9be3b2 |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
9be3b2 |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
9be3b2 |
@@ -43,7 +43,6 @@ CCE-85906-6
|
|
|
9be3b2 |
CCE-85907-4
|
|
|
9be3b2 |
CCE-85908-2
|
|
|
9be3b2 |
CCE-85909-0
|
|
|
9be3b2 |
-CCE-85910-8
|
|
|
9be3b2 |
CCE-85911-6
|
|
|
9be3b2 |
CCE-85912-4
|
|
|
9be3b2 |
CCE-85913-2
|
|
|
9be3b2 |
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
9be3b2 |
index 7d59cfff62..72e205b695 100644
|
|
|
9be3b2 |
--- a/tests/data/profile_stability/rhel8/stig.profile
|
|
|
9be3b2 |
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
9be3b2 |
@@ -24,6 +24,7 @@ documentation_complete: true
|
|
|
9be3b2 |
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
|
|
9be3b2 |
selections:
|
|
|
9be3b2 |
- account_disable_post_pw_expiration
|
|
|
9be3b2 |
+- account_emergency_expire_date
|
|
|
9be3b2 |
- account_temp_expire_date
|
|
|
9be3b2 |
- accounts_have_homedir_login_defs
|
|
|
9be3b2 |
- accounts_logon_fail_delay
|
|
|
9be3b2 |
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
9be3b2 |
index 2c2daad6f6..cc21621617 100644
|
|
|
9be3b2 |
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
9be3b2 |
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
9be3b2 |
@@ -35,6 +35,7 @@ documentation_complete: true
|
|
|
9be3b2 |
reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
|
|
|
9be3b2 |
selections:
|
|
|
9be3b2 |
- account_disable_post_pw_expiration
|
|
|
9be3b2 |
+- account_emergency_expire_date
|
|
|
9be3b2 |
- account_temp_expire_date
|
|
|
9be3b2 |
- accounts_have_homedir_login_defs
|
|
|
9be3b2 |
- accounts_logon_fail_delay
|