Account and Access

You can file an issue about it and ask that it be added.

---

Table of Contents

• Accounts and Access
  • Physical console access
  • Session configuration files
  • Banners
  • Passwords policy

Accounts and Access

In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access.

Therefore, making it more difficult for unauthorized people to gain shell access to accounts, particularly to privileged accounts, is a necessary part of securing a system.

Physical console access

Rationale

There are some steps which, if taken, make it more difficult for an attacker to quickly or undetectably modify a system from its console.

This is the easiest way to gain unauthorised access to a Linux system is to boot the server into single user mode. Attacker can select a kernel to boot from the grub menu item by pressing specific key to edit the boot option.

Remember to protect GRUB with password because it's the only way to protect single user mode in RedHat/CentOS distributions.

Solution

Authentication for single user mode

# C2S/CIS: CCE-27287-2 (Medium)

# Edit /usr/lib/systemd/system/rescue.service:
ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"

Policies

C2S/CIS: CCE-27287-2 (Medium)

Comments

I also recommend change or set these options in emergency.service. It is default target when an issue kicks in during the boot process.

Useful resources

• Console Access ^[Official]

Session configuration files

Rationale

When a user logs into a Unix account, the system configures the user's session by reading a number of files. Many of these files are located in the user's home directory, and may have weak permissions as a result of user error or misconfiguration.

Solution

Set sensible umask values

A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

# C2S/CIS: CCE-80202-5 (unknown), CCE-80204-1 (unknown)

# Edit /etc/profile and /etc/bashrc
umask 027

Policies

C2S/CIS: CCE-80202-5 (unknown); CCE-80204-1 (unknown)

Comments

I have seen recommendations in some guides (and in the real configurations) to set the umask 077 value. Many of Linux distributions are shipped by default with umask 022.

umask 027 is better from security perspective. umask 077 is even better to use for root (077 means that noone but the owner is able to read or execute newly-created files).

I'm sure there's a perfectly rational explanation why it is used:

• it avoids some common system administrator mistakes
• it's harder for an attacker to run privilege escalation

Useful resources

• Best practices for umask in Red Hat Enterprise Linux ^[Official]

Banners

Rationale

Login banners provide a definitive warning to any possible intruders that may want to access your system that certain types of activity are illegal, but at the same time, it also advises the authorized and legitimate users of their obligations relating to acceptable use of the computerized or networked environment(s).

Solution

The DoD required text is either:

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Policies

C2S/CIS: CCE-27303-7 (Medium)

Comments

Useful resources

• The real purpose of login banners (on Linux)