Detections
Analytics

1.198 SOL-11.1-090030

Information

Direct logins must not be permitted to shared, default, application, or utility accounts.

GROUP ID: V-216459
RULE ID: SV-216459r959010

Shared accounts (accounts where two or more people log in with the same user identification) do not provide identification and authentication. There is no way to provide for non-repudiation or individual accountability.

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Use the switch user ("su") command from a named account login to access shared accounts. Maintain audit trails that identify the actual user of the account name. Document requirements and procedures for users/administrators to log into their own accounts first and then switch user ("su") to the shared account.

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216459r959010_rule, STIG-ID|SOL-11.1-090030, Vuln-ID|V-216459

Plugin: Unix

Control ID: 206f7f01615d4fc1b6757069869c4db528840d317d4e934e59c275ca180fcfa0