SV-204467r991589: The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file. | Red Hat Enterprise Linux 7 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file.

Description

Discussion Text

If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own. In addition, if a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-72015SV-86639

References

DPMS Target Red Hat Enterprise Linux 7 DISA DPMS Target Red Hat Enterprise Linux 7 2899

Checks

DISA STIG (Manual Reference)

Verify local interactive users on the system have a home directory assigned and the directory exists.

Check the home directory assignment for all local interactive non-privileged users on the system with the following command:

# awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd

smithj 1001 /home/smithj

Note: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information.

Check that all referenced home directories exist with the following command:

# pwck -r
user 'smithj': directory '/home/smithj' does not exist

If any home directories referenced in "/etc/passwd" are returned as not defined, or if any interactive users do not have a home directory assigned, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel7:def:86639
# The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - file_object (file_test) -- Check each local non-system users home directory as defined in /etc/passwd exists.: cannot derive an existence probe for this object type
#   - file_object (file_test) -- Check root's home directory as defined in /etc/passwd exists.: cannot derive an existence probe for this object type

# Check for local non-system users in /etc/passwd without a home directory defined
# password_object (password_test)
test_1() {
  (getent passwd '[\w]+' | cut -d: -f6) | grep -Pq '.+'
}
# Check /etc/passwd if root has a home directory defined
# password_object (password_test)
test_2() {
  (getent passwd '[\w]+' | cut -d: -f6) | grep -Pq '.+'
}

if ( test_1 && test_2 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel7:def:86639


if [ ! -s /etc/passwd ]; then echo "PASS"; exit 0; fi

declare -a users=$(cat /etc/passwd | awk -F: '$6 != "" && $6 != "/sbin/nologin" && $6!~ /^\/\./ {print $1}' | sort | uniq)

for user in "${users[@]}"; do
    home_dir=$(grep "^$user:" /etc/passwd | cut -d: -f6)
    if [ -z "$home_dir" ]; then echo "FAIL"; exit 1; fi
    if [ ! -d "$home_dir" ]; then echo "FAIL"; exit 1; fi
done

echo "PASS"; exit 0

Remediation

Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd":

Note: The example will be for the user smithj, who has a home directory of "/home/smithj", a UID of "smithj", and a Group Identifier (GID) of "users" assigned in "/etc/passwd".

# mkdir /home/smithj 
# chown smithj /home/smithj
# chgrp users /home/smithj
# chmod 0750 /home/smithj