VMware ESX 3 Server

The VMware ESX 3 Server (V1 R2) has 630 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

630STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Fri Jul 22 2016

The system must restrict the ability to switch to the root user for members of a defined group.

VMware ESX 3 Server

Assessment Title

Rule Text

The system must restrict the ability to switch to the root user for members of a defined group.

Description

Discussion Text

Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-22308

Rule

SV-26348r1_rule

Severity

low

Rule Version

GEN000850

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Consult vendor documentation to determine if a specific configuration setting is available to restrict the ability to switch to the root user.  If there is, and this is not configured, this is a finding.

If there is not specific configuration, verify su is group-owned by the group permitted to access root and has no other execute permission.

Procedure:
# ls -l /bin/su

If the group owner is not the group permitted access to root, or if /bin/su is executable by other users, this is a finding.

Implementation Procedure

Fix Text

If the OS has a specific configuration setting to restrict access to root to a particular group, configure this in accordance with vendor documentation.

Otherwise, change the group ownership of su to the group permitted root access, and remove any other execute permission.

Procedure:
# chgrp <authorized group> /bin/su
# chmod o-x /bin/su

STIG check 151 of 630 in the VMware ESX 3 Server STIG checklist

← Previous · V-22307The system must prevent the use of dictionary words for passwords.Next · V-22309 →The root account's home directory must not have an extended ACL.