HP-UX 11.23 Security Technical Implementation Guide

The HP-UX 11.23 Security Technical Implementation Guide (V1 R8) has 534 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

534STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R8

CurrentPublished Fri Jan 22 2016

All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

HP-UX 11.23 Security Technical Implementation Guide

Assessment Title

Rule Text

All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

Description

Discussion Text

The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized shell that may not be secure.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-917

Rule

SV-35266r1_rule

Severity

medium

Rule Version

GEN002140

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Confirm the login shells referenced in the /etc/passwd file are listed in the /etc/shells file. 

Procedure:
# more /etc/passwd
# more /etc/shells

The /usr/bin/false, /bin/false, /dev/null, /sbin/nologin, (and equivalents), and sdshell will be considered valid shells for use in the /etc/passwd file, but will not be listed in the /etc/shells file.

If a shell referenced in /etc/passwd is not listed in the shells file, excluding the above mentioned shells, this is a finding.

Implementation Procedure

Fix Text

Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file.

STIG check 495 of 534 in the HP-UX 11.23 STIG checklist

← Previous · V-916The /etc/shells (or equivalent) file must exist.Next · V-918 →Accounts must be locked upon 35 days of inactivity.