Detections
Analytics

1.90 SOL-11.1-040200

Information

The system must restrict the ability of users to assume excessive privileges to members of a defined group and prevent unauthorized users from accessing administrative tools.

GROUP ID: V-220001RULE ID: SV-220001r958726

Allowing any user to elevate their privileges can allow them excessive control of the system tools.

Solution

The root role is required.

Convert the root user into a role.

usermod -K type=role root

Add the root role to authorized users' logins.

usermod -R +root [username]

Remove the root role from users who should not be authorized to assume it.

usermod -R -root [username]

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|II, CCI|CCI-002235, Rule-ID|SV-220001r958726_rule, STIG-ID|SOL-11.1-040200, Vuln-ID|V-220001

Plugin: Unix

Control ID: 6e5c092837534068c46e816fcb956229f75c3df4124fbee074e4cfb05783c9ce