Detections
Analytics

1.91 SOL-11.1-040230

Information

The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

GROUP ID: V-216340
RULE ID: SV-216340r1016277

Allowing any user to elevate their privileges can allow them excessive control of the system tools.

Solution

The root role is required.

Convert the root user into a role.

# usermod -K type=role root

Add the root role to authorized users' logins.

# usermod -R +root [username]

Remove the root role from users who should not be authorized to assume it.

# usermod -R -root [username]

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(5), CAT|II, CCI|CCI-000770, CCI|CCI-004045, Rule-ID|SV-216340r1016277_rule, STIG-ID|SOL-11.1-040230, Vuln-ID|V-216340

Plugin: Unix

Control ID: 7cf486ad77a5bf015a4739e0bb57216516afea6fb93faf0d272825b49c4f81fb