Bug 972475

Summary: The system must prevent the root account from logging in from virtual consoles.
Product: Red Hat Enterprise Linux 6 Reporter: Jason Pyeron <jpyeron>
Component: setupAssignee: Ondrej Vasik <ovasik>
Status: CLOSED WONTFIX QA Contact: qe-baseos-daemons
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.6CC: jason.j.pyeron.ctr, jrieden
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-19 14:33:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
RHEL6 STIG patch
none
specfile patch none

Description Jason Pyeron 2013-06-09 16:37:28 UTC 
Created attachment 758864 [details]
RHEL6 STIG patch

Description of problem:

The default configuration is not conforming to best practices. The Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG) v1.2 published by the Defense Information Systems Agency recommends the changes in the attached patch.

Version-Release number of selected component (if applicable):

http://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/setup-2.8.14-20.el6.src.rpm

How reproducible:

Always

Steps to Reproduce:

perform a yum install

Actual results:

root@test /tmp/setup
# grep '^vc/[0-9]' /etc/securetty
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
vc/7
vc/8
vc/9
vc/10
vc/11

Expected results:

No output form:
# grep '^vc/[0-9]' /etc/securetty


Additional info:

see: http://iase.disa.mil/stigs/os/unix/red_hat.html
Comment 1 Jason Pyeron 2013-06-09 16:39:01 UTC 
Created attachment 758865 [details]
specfile patch
Comment 3 Ondrej Vasik 2013-06-10 01:56:17 UTC 
Thanks for suggestion, in such cases it is not necessary to attach patches. I'll check if there is still some reason for having vc virtual consoles in securetty file, in http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm is mentioned that they may be required for backward compatibility.
Comment 4 Ondrej Vasik 2013-08-19 14:33:24 UTC 
Discussed with few guys from security technologies team and closing WONTFIX for RHEL-6. For RHEL-6, we need to keep them - otherwise it may break some setups. STIG is just recommendation for system modifications for higher system security, not something we want to always ship by default.