diff --git a/doc/metadata/rhel7/RHEL-07-020300.rst b/doc/metadata/rhel7/RHEL-07-020300.rst index df9b03b0..343c7199 100644 --- a/doc/metadata/rhel7/RHEL-07-020300.rst +++ b/doc/metadata/rhel7/RHEL-07-020300.rst @@ -1,7 +1,9 @@ --- id: RHEL-07-020300 -status: not implemented -tag: misc +status: implemented +tag: auth --- -This STIG requirement is not yet implemented. +If any users are found with invalid GIDs, those users are printed in the +Ansible output. Deployers should review the list and ensure all users are +assigned to a valid group that is defined in ``/etc/group``. diff --git a/tasks/rhel7stig/auth.yml b/tasks/rhel7stig/auth.yml index 4808db02..ee221ef5 100644 --- a/tasks/rhel7stig/auth.yml +++ b/tasks/rhel7stig/auth.yml @@ -14,8 +14,7 @@ # limitations under the License. - name: Get a list of users on the system to use throughout the auth tasks - get_users: - min_uid: 1000 + action: get_users register: user_list check_mode: no tags: @@ -305,6 +304,19 @@ - RHEL-07-020310 - skip_ansible_lint +- name: Check for groups in /etc/passwd that are not in /etc/group + debug: + msg: > + The following users have GIDs in /etc/passwd that do not exist in /etc/group: + {{ user_list.users | selectattr('group', 'equalto', False) | map(attribute='name') | join(', ') }} + when: + - user_list is defined + - user_list.users | selectattr('group', 'equalto', False) | list | length > 0 + tags: + - auth + - low + - RHEL-07-020300 + - name: RHEL-07-020310 - The root account must be the only account having unrestricted access to the system fail: msg: |