Ensure Home Directories are Created for New Users

An XCCDF Rule

Description

All local interactive user accounts, upon creation, should be assigned a home directory.

Configure the operating system to assign home directories to all new local interactive users by setting the CREATE_HOME parameter in /etc/login.defs to yes as follows:

CREATE_HOME yes

Rationale

If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.

ID: xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs
Severity: Medium
References: CCI-000366

SRG-OS-000480-GPOS-00227
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - accounts_have_homedir_login_defs
  - low_complexity  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure new users receive home directories
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: ^\s*CREATE_HOME\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/login.defs
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: ^\s*CREATE_HOME\s+
      state: absent
    when: dupes.found is defined and dupes.found > 1

  - name: Insert correct line to /etc/login.defs
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: ^\s*CREATE_HOME\s+
      line: CREATE_HOME yes
      state: present
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - accounts_have_homedir_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

# Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

if [ -e "/etc/login.defs" ] ; then
    
    LC_ALL=C sed -i "/^\s*CREATE_HOME\s\+/Id" "/etc/login.defs"else
    touch "/etc/login.defs"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/login.defs"

cp "/etc/login.defs" "/etc/login.defs.bak"
# Insert before the line matching the regex '^\s*CREATE_HOME'.
line_number="$(LC_ALL=C grep -n "^\s*CREATE_HOME" "/etc/login.defs.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^\s*CREATE_HOME', insert at
    # the end of the file.
    printf '%s\n' "CREATE_HOME yes" >> "/etc/login.defs"
else
    head -n "$(( line_number - 1 ))" "/etc/login.defs.bak" > "/etc/login.defs"
    printf '%s\n' "CREATE_HOME yes" >> "/etc/login.defs"
    tail -n "+$(( line_number ))" "/etc/login.defs.bak" >> "/etc/login.defs"
fi
# Clean up after ourselves.
rm "/etc/login.defs.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure Home Directories are Created for New Users

Description

Rationale

Remediation - Ansible

Remediation - Shell Script