Detections
Analytics

1.91 SOL-11.1-040230

Information

The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.

GROUP ID: V-216105RULE ID: SV-216105r1016292

Allowing any user to elevate their privileges can allow them excessive control of the system tools.

Solution

The root role is required.

Convert the root user into a role.

usermod -K type=role root

Add the root role to authorized users' logins.

usermod -R +root [username]

Remove the root role from users who should not be authorized to assume it.

usermod -R -root [username]

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(5), CAT|II, CCI|CCI-000770, CCI|CCI-004045, Rule-ID|SV-216105r1016292_rule, STIG-ID|SOL-11.1-040230, Vuln-ID|V-216105

Plugin: Unix

Control ID: a77029932cb1d57ce3fc2c993f0d605efa2b772b4599ef3cc537696837038003