The system must restrict the ability to switch to the root user to members of a defined group.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-226470	GEN000850	SV-226470r603265_rule		Low

Description
Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing the root account, even with knowledge of the root credentials.

STIG	Date
Solaris 10 SPARC Security Technical Implementation Guide	2020-12-04

Details

Check Text ( C-28631r482789_chk )
Verify the root user is configured as a role, rather than a normal user. # egrep '^root:' /etc/user_attr If the returned line does not include "type=role", this is a finding. Verify at least one local user has been assigned the root role. # egrep '[:;]roles=[^;]*,?root([,;]|$)' /etc/user_attr If no lines are returned, no users are permitted to assume the root role, this is a finding.

Fix Text (F-28619r482790_fix)
Convert the root user into a role. # usermod -K type=role root Add the root role to authorized users' logins. # usermod -R root