Detections
Analytics

5.4.2.4 Ensure root account access is controlled

Information

There are several ways to gain access to the root account directly: authenticating at the console or a login prompt, switching to it with the su command, or opening a root shell through sudo . Direct access to the root account is governed by its authentication state: whether a password is set and whether the account is locked.

If the root account has no password set and is not locked, any user who can reach a root login prompt or otherwise select the root account can gain access without authenticating, and thus gain control over the entire system. Ensuring that the root password is set, or that the root account is locked so that direct authentication is disabled in favor of an auditable escalation path such as sudo, prevents an unauthenticated user from taking control of the system.

Solution

Run the following command to set a password for the root user:

# passwd root

- OR -

Run the following command to lock the root user account:

# usermod -L root

Impact:

If there are any automated processes that rely on access to the root account without authentication, they will fail after remediation.

Note: Locking the root account can prevent emergency or rescue (single-user) login. Before locking root, ensure an alternative means to obtain privilege (for example, a sudo-capable administrative account) is in place.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: 03cf556a78245838d42dff9e1abe6dd5cbcf98e8d9f8cdb5943e9ae17b37a30d