<def-group>
  <definition class="compliance" id="ftp_anonymous_shell"
  version="1">
    <metadata>
      <title>Anonymous FTP Shell</title>
      <affected family="unix">
        <platform>CentOS 4</platform>
		<platform>CentOS 5</platform>
		<platform>Red Hat Enterprise Linux 4</platform>
		<platform>Red Hat Enterprise Linux 5</platform>
      </affected>
      <description>Anonymous FTP accounts must not have a functional shell.</description>
    </metadata>
	<criteria>
		<criterion test_ref="test_ftp_anonymous_shell" />
	</criteria>
  </definition>

  <unix:password_test check="all" check_existence="any_exist" comment="ftp shell" id="test_ftp_anonymous_shell" version="1">
    <unix:object object_ref="object_ftp_anonymous_shell" />
    <unix:state state_ref="state_ftp_anonymous_shell" />
  </unix:password_test>
  
  <unix:password_object id="object_ftp_anonymous_shell" version="3">
    <unix:username datatype="string" operation="pattern match">^ftp$</unix:username>
  </unix:password_object>

  <unix:password_state id="state_ftp_anonymous_shell" version="3">
    <unix:login_shell datatype="string" operation="pattern match">^(/bin/false|/dev/null|/usr/bin/false|/bin/true|/sbin/nologin)$</unix:login_shell>
  </unix:password_state>

</def-group>