← Back to Solaris 11 X86 Security Technical Implementation Guide

V-216124

CAT II (Medium)

Logins to the root account must be restricted to the system console only.

Rule ID

SV-216124r959010_rule

STIG

Solaris 11 X86 Security Technical Implementation Guide

Version

V3R5

CCIs

CCI-000366

Discussion

Use an authorized mechanism such as RBAC and the "su" command to provide administrative access to unprivileged accounts. These mechanisms provide an audit trail in the event of problems.

Check Content

This check applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

Determine if root login is restricted to the console.

# grep "^CONSOLE=/dev/console" /etc/default/login

If the output of this command is not:

CONSOLE=/dev/console

this is a finding.

Fix Text

The root role is required.

Modify the /etc/default/login file

# pfedit /etc/default/login

Locate the line containing:

CONSOLE

Change it to read:

CONSOLE=/dev/console