From 28a35960d7acb7e6c69cdaa9c90fe3663d00ba97 Mon Sep 17 00:00:00 2001 From: Jeffrey van Pelt Date: Mon, 11 Nov 2024 17:38:04 +0100 Subject: [PATCH] Added a means to allow system users to have a shell Signed-off-by: Jeffrey van Pelt --- defaults/main.yml | 5 +++++ tasks/section_5/cis_5.6.x.yml | 1 + 2 files changed, 6 insertions(+) diff --git a/defaults/main.yml b/defaults/main.yml index e3dc9b5..0cc7a2b 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1137,6 +1137,11 @@ rhel9cis_force_user_mindays: false # This can break current connecting user access rhel9cis_force_user_warnage: false +## Control 5.6.2 - Ensure system accounts are secured | Set nologin +# The system users on this list are allowed to have a shell (e.g. applications +# that require a shell to function) +rhel9cis_system_users_shell: [] + ## Control 5.6.3 - Ensure default user shell timeout is 900 seconds or less # Session timeout setting file (TMOUT setting can be set in multiple files) # Timeout value is in seconds. (60 seconds * 10 = 600) diff --git a/tasks/section_5/cis_5.6.x.yml b/tasks/section_5/cis_5.6.x.yml index 5271388..11bed39 100644 --- a/tasks/section_5/cis_5.6.x.yml +++ b/tasks/section_5/cis_5.6.x.yml @@ -13,6 +13,7 @@ - item.id != "shutdown" - item.id != "halt" - item.id != "nfsnobody" + - item.id not in rhel9cis_system_users_shell - item.uid < min_int_uid | int - item.shell != "/bin/false" - item.shell != "/usr/sbin/nologin"