Restrict Virtual Console Root Logins

An XCCDF Rule

Description

To restrict root logins through the (deprecated) virtual console devices, ensure lines of this form do not appear in /etc/securetty:

vc/1
vc/2
vc/3
vc/4

Rationale

Preventing direct root login to virtual console devices helps ensure accountability for actions taken on the system using the root account.

ID: xccdf_org.ssgproject.content_rule_securetty_root_login_console_only
Severity: Medium
References: 12 13 14 15 16 18 3 5

APO01.06 DSS05.04 DSS05.07 DSS06.02

3.1.1 3.1.5

CCI-000770

164.308(a)(1)(ii)(B) 164.308(a)(7)(i) 164.308(a)(7)(ii)(A) 164.310(a)(1) 164.310(a)(2)(i) 164.310(a)(2)(ii) 164.310(a)(2)(iii) 164.310(b) 164.310(c) 164.310(d)(1) 164.310(d)(2)(iii)

4.3.3.7.3

SR 2.1 SR 5.2

A.10.1.1 A.11.1.4 A.11.1.5 A.11.2.1 A.13.1.1 A.13.1.3 A.13.2.1 A.13.2.3 A.13.2.4 A.14.1.2 A.14.1.3 A.6.1.2 A.7.1.1 A.7.1.2 A.7.3.1 A.8.2.2 A.8.2.3 A.9.1.1 A.9.1.2 A.9.2.3 A.9.4.1 A.9.4.4 A.9.4.5

CIP-003-8 R5.1.1 CIP-003-8 R5.3 CIP-004-6 R2.3 CIP-007-3 R2.1 CIP-007-3 R2.2 CIP-007-3 R2.3 CIP-007-3 R5.1 CIP-007-3 R5.1.1 CIP-007-3 R5.1.2

AC-6 CM-6(a)

PR.AC-4 PR.DS-5

8.6.1

SRG-OS-000324-GPOS-00125
Updated: about 1 year ago

- name: Restrict Virtual Console Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ^vc
    state: absent
  tags:  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.6.1
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - securetty_root_login_console_only

sed -i '/^vc\//d' /etc/securetty

Restrict Virtual Console Root Logins

Description

Rationale

Remediation - Ansible

Remediation - Shell Script