Detections
Analytics

1.90 SOL-11.1-040200

Information

The system must restrict the ability of users to assume excessive privileges to members of a defined group and prevent unauthorized users from accessing administrative tools.

GROUP ID: V-219973
RULE ID: SV-219973r958726

Allowing any user to elevate their privileges can allow them excessive control of the system tools.

Solution

The root role is required.

Convert the root user into a role.

# usermod -K type=role root

Add the root role to authorized users' logins.

# usermod -R +root [username]

Remove the root role from users who should not be authorized to assume it.

# usermod -R -root [username]

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(4), CAT|II, CCI|CCI-001170, Rule-ID|SV-219973r958726_rule, STIG-ID|SOL-11.1-040200, Vuln-ID|V-219973

Plugin: Unix

Control ID: 0174e20966da7a508c4bd485d27a494432a0478f387c15666b0a81477eb42dd8