All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-917	GEN002140	SV-38742r1_rule	ECSC-1	Medium

Description
The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users cannot change their default shell to an unauthorized shell that may not be secure.

STIG	Date
AIX 6.1 Security Technical Implementation Guide	2013-03-27

Details

Check Text ( C-37177r1_chk )
Confirm the login shells referenced in the /etc/passwd file are listed in the /etc/security/login.cfg file's shells =variable in the usw stanza. # more /etc/security/login.cfg # more /etc/shells The /usr/bin/false, /bin/false, /dev/null, /sbin/nologin, (and equivalents), and sdshell will be considered valid shells for use in the /etc/passwd file, but will not be listed in the shells stanza. If a shell referenced in /etc/passwd is not listed in the shells stanza, excluding the above mentioned shells, then this is a finding.

Check Text ( C-37177r1_chk )

Confirm the login shells referenced in the /etc/passwd file are listed in the /etc/security/login.cfg file's shells =variable in the usw stanza.

# more /etc/security/login.cfg
# more /etc/shells

The /usr/bin/false, /bin/false, /dev/null, /sbin/nologin, (and equivalents), and sdshell will be considered valid shells for use in the /etc/passwd file, but will not be listed in the shells stanza. If a shell referenced in /etc/passwd is not listed in the shells stanza, excluding the above mentioned shells, then this is a finding.

Fix Text (F-32457r1_fix)
Use the chsh utility or edit the /etc/passwd file and correct the error by changing the default shell of the account in error to an acceptable shell name contained in the /etc/shells file. Alternatively, use the SMIT to change the /etc/passwd shell entry.