Bug 972475 - The system must prevent the root account from logging in from virtual consoles.
The system must prevent the root account from logging in from virtual consoles.
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: setup (Show other bugs)
6.6
All Linux
unspecified Severity high
: rc
: ---
Assigned To: Ondrej Vasik
qe-baseos-daemons
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-09 12:37 EDT by Jason Pyeron
Modified: 2013-08-19 10:33 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-19 10:33:24 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
RHEL6 STIG patch (217 bytes, patch)
2013-06-09 12:37 EDT, Jason Pyeron
no flags Details | Diff
specfile patch (1.21 KB, patch)
2013-06-09 12:39 EDT, Jason Pyeron
no flags Details | Diff

  None (edit)
Description Jason Pyeron 2013-06-09 12:37:28 EDT
Created attachment 758864 [details]
RHEL6 STIG patch

Description of problem:

The default configuration is not conforming to best practices. The Red Hat Enterprise Linux 6 Security Technical Implementation Guide (STIG) v1.2 published by the Defense Information Systems Agency recommends the changes in the attached patch.

Version-Release number of selected component (if applicable):

http://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/setup-2.8.14-20.el6.src.rpm

How reproducible:

Always

Steps to Reproduce:

perform a yum install

Actual results:

root@test /tmp/setup
# grep '^vc/[0-9]' /etc/securetty
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
vc/7
vc/8
vc/9
vc/10
vc/11

Expected results:

No output form:
# grep '^vc/[0-9]' /etc/securetty


Additional info:

see: http://iase.disa.mil/stigs/os/unix/red_hat.html
Comment 1 Jason Pyeron 2013-06-09 12:39:01 EDT
Created attachment 758865 [details]
specfile patch
Comment 3 Ondrej Vasik 2013-06-09 21:56:17 EDT
Thanks for suggestion, in such cases it is not necessary to attach patches. I'll check if there is still some reason for having vc virtual consoles in securetty file, in http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm is mentioned that they may be required for backward compatibility.
Comment 4 Ondrej Vasik 2013-08-19 10:33:24 EDT
Discussed with few guys from security technologies team and closing WONTFIX for RHEL-6. For RHEL-6, we need to keep them - otherwise it may break some setups. STIG is just recommendation for system modifications for higher system security, not something we want to always ship by default.

Note You need to log in before you can comment on or make changes to this bug.