florianutz / ubuntu2004_cis

Ubuntu CIS Hardening Ansible Role
MIT License
108 stars 67 forks source link

Added line for /etc/pam.d/su is incomplete (rule 5.6) #25

Open jeremy-evidos opened 3 years ago

jeremy-evidos commented 3 years ago

Hello,

The added line for rule 5.6 is incomplete. The current line is: line: "auth required pam_wheel.so use_uid" Proposed possible solution which is in line with the remediation for section 5.6 of the CIS benchmark: line: "auth required pam_wheel.so use_uid group=nogroup" Instead of nogroup any other empty user group could be used, a separate group could also be created and used as proposed by the CIS benchmark.

Best,

Jeremy