Rule ID
SV-285675r1272697_rule
STIG
Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation GuideVersion
V1R1
Preventing nonprivileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Nonprivileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from nonprivileged users. Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000001-GPOS-00001, SRG-OS-000104-GPOS-00051, SRG-OS-000109-GPOS-00056, SRG-OS-000118-GPOS-00060, SRG-OS-000121-GPOS-00062, SRG-OS-000123-GPOS-00064, SRG-OS-000125-GPOS-00065, SRG-OS-000132-GPOS-00067, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000259-GPOS-00100, SRG-OS-000298-GPOS-00116, SRG-OS-000300-GPOS-00118, SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124, SRG-OS-000326-GPOS-00126, SRG-OS-000362-GPOS-00149, SRG-OS-000364-GPOS-00151, SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162, SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00230, SRG-OS-000590-GPOS-00110, SRG-OS-000720-GPOS-00170, SRG-OS-000730-GPOS-00190, SRG-OS-000745-GPOS-00210, SRG-OS-000313-GPOS-00124, SRG-OS-000835-GPOS-00305
Verify that the Harvester Government system does not contain unauthorized nonsystem user accounts.
1. Access the Harvester node OS via a privileged account.
2. Enumerate all local OS accounts with one of the following commands:
cat /etc/passwd
or
getent passwd
3. Review the output and identify all accounts. Determine which accounts are system/service accounts versus nonsystem (interactive) user accounts.
System/service accounts typically have nonlogin shells (e.g., /sbin/nologin, /bin/false) and are required for platform operation (e.g., rancher, Kubernetes, container runtime, or OS services).
Nonsystem user accounts typically have interactive login shells (e.g., /bin/bash, /bin/sh) and are not explicitly authorized or documented.
The following command may be used to identify accounts with interactive shells:
awk -F: '$7 !~ /(nologin|false)/ {print $1,$7}' /etc/passwd
If any unauthorized system/service accounts are present, this is a finding.
If any unauthorized nonsystem user accounts are present, this is a finding.
If the break-glass "rancher" account is not present, this is a finding.Configure the Harvester Government system to remove nonsystem users. 1. Access the Harvester node OS via a privileged account. 2. Enumerate all local OS accounts with the following command: cat /etc/passwd or getent passwd 3. Review the list of accounts and identify all noninteractive system accounts. 4. Delete any nonsystem users (but do not delete the "rancher" user) using this command: userdel -f [username]