userdb database must not be used to override the system-wide variables in the security file, unless required.

From HP-UX 11.31 Security Technical Implementation Guide

Part of GEN000000-HPUX0200

Associated with IA controls: DCSW-1

Associated with: CCI-000366

SV-52330r1_rule userdb database must not be used to override the system-wide variables in the security file, unless required.

Vulnerability discussion

The user database stores per-user information. It consists of the /var/adm/userdb directory and the files within it. A per-user value in /var/adm/userdb will override any corresponding system-wide default configured in the /etc/default/security file. Allowing per-user files to relax system-wide security settings creates potential security gaps that can compromise overall system security.

Check content

If the system is operating in Trusted Mode, this check is not applicable. For SMSE: Check the /var/adm/userdb database for individual user settings: # /usr/sbin/userdbget -a If the “userdb” database is used exclusively to enhance/tighten the security requirements as defined in the /etc/default/security file (see the following example), this is not a finding. Example: /etc/default/security requires a MIN_PASSWORD_LENGTH attribute setting of N=14 and specific per user attribute values in /var/adm/userdb are set to 15. If any user information is returned that is greater than the required attribute setpoint in the/etc/default/security file (see the following example), this is a finding. Example: /etc/default/security requires a MIN_PASSWORD_LENGTH attribute setting of N=14 and specific per user attribute values in /var/adm/userdb are set to 13.

Fix text

If the system is operating in Trusted Mode, no fix is required. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Delete any configured users from the /var/adm/userdb database: # /usr/sbin/userdbset -d -u Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer