NAME
Monitoring::Sneck::Checks::accounts - checks local user accounts
VERSION
Version 0.0.1
SYNOPSIS
!accounts|control=CIS-6.2 framework=CIS|perl:accounts -s
!no_guest||perl:accounts -a guest -a test -p backupDESCRIPTION
Checks the local accounts, from the files, not through NSS, so those from LDAP and the like are not looked at. Each of these is CRITICAL.
- a UID of 0 :: For any account not given by --uid0, by default root, and toor on FreeBSD.
- no password :: An account with a empty password field, which can log in without one. Locked accounts, * or !, are fine. This needs reading /etc/shadow, or /etc/master.passwd on FreeBSD, so root. Not being able to is UNKNOWN, unless --no-passwords is given. A empty field in /etc/passwd itself counts too, as that is what is used then, whatever /etc/shadow has.
- duplicates :: Two accounts with the same name or UID. UID 0 is left to the check above.
- --absent and --present :: Accounts that must not, or must, be there.
- --system-shells :: System accounts, those under --min-uid, with a shell from /etc/shells, read as getusershell does, so one that can log in. root, sync, shutdown, halt, and toor are left out, as are those given by --ignore.
Other OSes than Linux and FreeBSD are UNKNOWN.
OPTIONS
- -u, --uid0 :: A account that may have a UID of 0. May be given more than once. Default :: root, and toor on FreeBSD
- -n, --no-passwords :: Do not check for empty passwords.
- -s, --system-shells :: Check system accounts do not have a login shell.
- -m, --min-uid :: The lowest UID of accounts for people. Default :: 1000
- -i, --ignore :: A system account that may have a login shell. May be given more than once.
- -a, --absent :: A account that must not be there. May be given more than once.
- -p, --present :: A account that must be there. May be given more than once.
METHODS
check
Does the check.
accounts
Returns a array ref of the local accounts, as hash refs of name, uid, password, the field as it is in the file, and shell, in the order they are in the file. Dies if it can not be read.
passwords
Returns a hash ref of account names to the password fields that are used for them, or undef if the shadow file can not be read.
- accounts :: From "accounts", for the fields in passwd itself.
The field is the one from /etc/shadow, or /etc/master.passwd on FreeBSD, unless the one in passwd is empty, as the C library and PAM go by passwd then, and a empty one there means no password.
my $passwords = $check->passwords( $check->accounts );shells
Returns the login shells in /etc/shells, read as getusershell does. Each line gives one, the first thing on it starting with a /, and lines with a # before that are comments. None if it can not be read.