The system must impose the same restrictions on root logins that are already applied to non-root users.

From HP-UX 11.31 Security Technical Implementation Guide

Associated with: CCI-000366

SV-52432r2_rule The system must impose the same restrictions on root logins that are already applied to non-root users.

Vulnerability discussion

Best practices standard operating procedures for computing systems includes account management. If the root account is allowed to be configured without a password, or not configured to lock if there have been no logins to the root account for an organization defined time interval, the entire system can be compromised.

Check content

If the system is configured for Trusted Mode, this check is not applicable. For Standard Mode with Security Extensions (SMSE): Check the /etc/default/security file for the following attribute(s) and attribute values: LOGIN_POLICY_STRICT=1 # grep “LOGIN_POLICY_STRICT” /etc/default/security If LOGIN_POLICY_STRICT=0, then the root user is not subject to the same login restrictions as non-root users. If no organizational exceptions for root are documented and LOGIN_POLICY_STRICT=0, then this is a finding.

Fix text

If the system is operating in Trusted Mode, no fix is required. For SMSE: Edit the /etc/default/security file and add/modify the following attribute(s) and attribute values: LOGIN_POLICY_STRICT=1 Save the file before exiting the editor.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.