SV-37379r1: All interactive user home directories defined in the /etc/passwd file must exist. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

All interactive user home directories defined in the /etc/passwd file must exist.

Description

Discussion Text

If a user has a home directory defined that does not exist, the user may be given the / directory, by default, as the current working directory upon logon. This could create a Denial of Service because the user would not be able to perform useful tasks in this location.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000225

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.rhel11:def:111
users=$(getent passwd | awk -F: '$2 != ""' '{print $1}' | sort -u)
for user in $users; do
    home_dir=$(getent passwd "$user" | awk -F: '{print $6}')
    [ -n "$home_dir" ] || { echo "FAIL"; exit 1; }
    [ -d "$home_dir" ] || { echo "FAIL"; exit 1; }
done
echo "PASS"
exit 0

Remediation

If a user has no home directory, determine why. If possible, delete accounts without a home directory. If the account is valid, then create the home directory using the appropriate system administration utility or manually.
For instance: mkdir directoryname; copy the skeleton files into the directory; chown accountname for the new directory and the skeleton files. Document all changes.