The system must restrict the ability to switch to the root user to members of a defined group.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22308	GEN000850	SV-37345r1_rule	ECLP-1	Low

Description
Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2017-03-01

Details

Check Text ( C-27453r1_chk )
Check /etc/pam.d/su uses pam_wheel. # grep pam_wheel /etc/pam.d/su If pam_wheel is not present, or is commented out, this is a finding.

Fix Text (F-31282r1_fix)
Edit /etc/pam.d/su and uncomment or add a line such as "auth required pam_wheel.so". If necessary, create a "wheel" group and add administrative users to the group.