3:45 p.m.
What is the proper way to disable RHEL6's user account list? See this bug:
http://bugzilla.redhat.com/show_bug.cgi?id=666220
Is this setting something that needs to be checked?
Andrew Gilmore
3:55 p.m.
Yes -- there has been an outstanding ticket for
"research security-relevant gconf settings" for quite a while:
https://fedorahosted.org/scap-security-guide/ticket/11
If you'd like to take stab at it, patches are welcome!
On 10/17/2012 04:45 PM, Andrew Gilmore wrote:
What is the proper way to disable RHEL6's user account list? See
this bug:
http://bugzilla.redhat.com/show_bug.cgi?id=666220
Is this setting something that needs to be checked?
Andrew Gilmore
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
4:34 p.m.
And I've added some commentary to that ticket on how the user account
list can be disabled and a banner set as an example in the comments.
gconftool-2 can be used to set and get values for gconf variables on the
command line. GDM by default will read from the gconf settings folder in
the gdm user's home directory (/var/lib/gdm/.gconf).
- Maura Dailey
On 10/17/2012 04:55 PM, Jeffrey Blank wrote:
Yes -- there has been an outstanding ticket for
"research security-relevant gconf settings" for quite a while:
https://fedorahosted.org/scap-security-guide/ticket/11
If you'd like to take stab at it, patches are welcome!
On 10/17/2012 04:45 PM, Andrew Gilmore wrote:
> What is the proper way to disable RHEL6's user account list? See this bug:
> http://bugzilla.redhat.com/show_bug.cgi?id=666220
> Is this setting something that needs to be checked?
>
> Andrew Gilmore
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
4:34 p.m.
On 10/17/12 4:45 PM, Andrew Gilmore wrote:
What is the proper way to disable RHEL6's user account list? See
this
bug:
http://bugzilla.redhat.com/show_bug.cgi?id=666220
Is this setting something that needs to be checked?
to turn off:
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
to validate:
gconftool-2 /apps/gdm/simple-greeter/disable_user_list
Expected output should return a line that says "true"
4:47 p.m.
On 10/17/12 5:34 PM, Shawn Wells wrote:
On 10/17/12 4:45 PM, Andrew Gilmore wrote:
> What is the proper way to disable RHEL6's user account list? See this
> bug:
> http://bugzilla.redhat.com/show_bug.cgi?id=666220
> Is this setting something that needs to be checked?
>
to turn off:
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
to validate:
gconftool-2 /apps/gdm/simple-greeter/disable_user_list
that should be gconftool-2 -g /apps/gdm/simple-greeter/disable_user_list
Expected output should return a line that says "true"
5:05 p.m.
On 10/17/2012 05:47 PM, Shawn Wells wrote:
On 10/17/12 5:34 PM, Shawn Wells wrote:
> On 10/17/12 4:45 PM, Andrew Gilmore wrote:
>> What is the proper way to disable RHEL6's user account list? See
>> this bug:
>> http://bugzilla.redhat.com/show_bug.cgi?id=666220
>> Is this setting something that needs to be checked?
>>
>
To make settings stick for the gdm user/GDM, settings have to be written
to the gdm user's home directory. Sudo lets you run commands as another
user.
> to turn off:
> gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
>
When setting a value, you have to specify the type:
sudo -u gdm gconftool-2 -t boolean -s
/apps/gdm/simple-greeter/disable_user_list true
>
> to validate:
> gconftool-2 /apps/gdm/simple-greeter/disable_user_list
that should be gconftool-2 -g /apps/gdm/simple-greeter/disable_user_list
Run it as the gdm user to make sure it's reading from the correct
settings directory:
sudo -u gdm gconftool-2 -g /apps/gdm/simple-greeter/disable_user_list
> Expected output should return a line that says "true"
This value can also be read directly from
/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
4:57 p.m.
There should also be consideration for hosts that wouldn't have gconftool-2 installed,
or even anything of X much less a window manager.
R,
-Joe
________________________________
From: Shawn Wells <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Wednesday, October 17, 2012 5:34 PM
Subject: Re: List of user accounts
On 10/17/12 4:45 PM, Andrew Gilmore wrote:
> What is the proper way to disable RHEL6's user account list? See this bug:
> http://bugzilla.redhat.com/show_bug.cgi?id=666220
> Is this setting something that needs to be checked?
>
to turn off:
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
to validate:
gconftool-2 /apps/gdm/simple-greeter/disable_user_list
Expected output should return a line that says "true"
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
5 p.m.
Yes, good point -- whatever OVAL checks are constructed for gconf tests
should be sure to automatically pass if X isn't there.
On 10/17/2012 05:57 PM, Joe Wulf wrote:
There should also be consideration for hosts that wouldn't have
gconftool-2 installed, or even anything of X much less a window manager.
R,
-Joe
*From:* Shawn Wells <shawn(a)redhat.com>
*To:* scap-security-guide(a)lists.fedorahosted.org
*Sent:* Wednesday, October 17, 2012 5:34 PM
*Subject:* Re: List of user accounts
On 10/17/12 4:45 PM, Andrew Gilmore wrote:
> What is the proper way to disable RHEL6's user account list? See
this bug:
> http://bugzilla.redhat.com/show_bug.cgi?id=666220
> Is this setting something that needs to be checked?
>
to turn off:
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
to validate:
gconftool-2 /apps/gdm/simple-greeter/disable_user_list
Expected output should return a line that says "true"
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
5:14 p.m.
On Wednesday, October 17, 2012 06:00:05 PM Jeffrey Blank wrote:
Yes, good point -- whatever OVAL checks are constructed for gconf
tests
should be sure to automatically pass if X isn't there.
We are within a day or two (unless there are problems) from releasing a new
version of openscap. It adds the CPE applicability feature. So, things like
this can be optionally run.
-Steve
5:01 p.m.
On 10/17/12 5:57 PM, Joe Wulf wrote:
There should also be consideration for hosts that wouldn't have
gconftool-2 installed, or even anything of X much less a window manager.
.... if there is no window manager, something tells me preventing the
window manager from displaying a list of known users would be a moot
point anyway? ;)
This actually brings up an interesting point: If we're making a *server*
STIG, why shouldn't we simple state not to install desktop software?
5:07 p.m.
In production environments, it will always depend on what that servers' requirements
are.
We can try to assume that, in general, a 'production' server wouldn't have
such-and-such (whatever part or piece is applicable to the discussion, 'X' in this
case). Doesn't translate to real-world many times.
An approach that does work well, is to say that for a security 'standard',
we'll recommend not installing such-and-such. When you don't have it, your system
is 'compliant'. When you do have it, it isn't a 'failure' per se, but
a noticeable event that is 'less' secure than the recommendation.
R,
-Joe
________________________________
From: Shawn Wells <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Wednesday, October 17, 2012 6:01 PM
Subject: Re: List of user accounts
On 10/17/12 5:57 PM, Joe Wulf wrote:
> There should also be consideration for hosts that wouldn't have gconftool-2
installed, or even anything of X much less a window manager.
>
.... if there is no window manager, something tells me preventing the window manager from
displaying a list of known users would be a moot point anyway? ;)
This actually brings up an interesting point: If we're making a *server* STIG, why
shouldn't we simple state not to install desktop software?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
4218
days inactive
4218
days old
scap-security-guide@lists.fedorahosted.org
10 comments
6 participants
participants (6)
-
Andrew Gilmore -
Jeffrey Blank -
Joe Wulf -
Maura Dailey -
Shawn Wells -
Steve Grubb