Solaris 11 SPARC Security Technical Implementation Guide

The Solaris 11 SPARC Security Technical Implementation Guide (V3 R7) has 215 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

215STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R7

CurrentPublished Wed Sep 30 2026

The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

Solaris 11 SPARC Security Technical Implementation Guide

Assessment Title

Rule Text

The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

Description

Discussion Text

Allowing any user to elevate their privileges can allow them excessive control of the system tools.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-216340

Rule

SV-216340r1016277_rule

Severity

medium

Rule Version

SOL-11.1-040230

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the root user is configured as a role, rather than a normal user. 

# userattr type root

If the command does not return the word "role", this is a finding.

Verify at least one local user has been assigned the root role.

# grep '[:;]roles=root[^;]*' /etc/user_attr

If no lines are returned, or no users are permitted to assume the root role, this is a finding.

Implementation Procedure

Fix Text

The root role is required.

Convert the root user into a role. 

# usermod -K type=role root

Add the root role to authorized users' logins. 

# usermod -R +root [username]

Remove the root role from users who should not be authorized to assume it.

# usermod -R -root [username]

STIG check 76 of 215 in the Solaris 11 SPARC STIG checklist

← Previous · V-216338The system must prevent the use of dictionary words for passwords.Next · V-216341 →The default umask for system and users must be 077.