71f942de10
CIS Benchmark considers the characters * and ! in the password field in
the /etc/shadow file to indicate that a user does not have a password
and is unable to log in if prompted for a password.
This replaces the character 'x' in some of those users with a '*' so the
benchmark can skip those users when checking some password-related
settings.
Test Plan:
PASS: Run build-pkgs -c -p base-passwd.
PASS: Run build-image.
PASS: Run fresh install of AIO-SX with complete bootstrap and unlock of
the controller-0.
PASS: Run fresh install of AIO-DX with complete bootstrap and unlock of
controller-0 and controller-1.
PASS: Run backup and restore with complete bootstrap.
PASS: Try to log in with user 'keystone' via SSH and verify that it has
the same behavior as before: asks for a password, but there is no
valid password to use.
Story: 2011283
Task: 51442
Change-Id: I1aceacd4153a479e4e3b7efa0f74b73abbd298c2
Signed-off-by: Rodrigo Tavares <Rodrigo.DosSantosTavares@windriver.com>
104 lines
3.2 KiB
Diff
104 lines
3.2 KiB
Diff
From 78ad07ad266124cb5dad021e7bdc9d7ec5edc8f8 Mon Sep 17 00:00:00 2001
|
|
From: Al Bailey <Al.Bailey@windriver.com>
|
|
Date: Thu, 24 Oct 2019 11:53:01 -0500
|
|
Subject: [PATCH 1/2] Change group,passwd
|
|
|
|
Porting this patch from 'setup' package of CentOS. Removing the
|
|
change of uidgid, because no such file in base-passwd, and Debian
|
|
system. The file is installed into /usr/share/doc/setup-2.8.71/uidgid
|
|
in CentOS, which is just a doc file, so ignore it.
|
|
|
|
Signed-off-by: Andy Ning <andy.ning@windriver.com>
|
|
Signed-off-by: Al Bailey <Al.Bailey@windriver.com>
|
|
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
|
Signed-off-by: Charles Short <charles.short@windriver.com>
|
|
Signed-off-by: Dan Voiculeasa <dan.voiculeasa@windriver.com>
|
|
Signed-off-by: Luis Eduardo Bonatti <LuizEduardo.Bonatti@windriver.com>
|
|
---
|
|
group.master | 17 ++++++++++-------
|
|
passwd.master | 14 +++++++++-----
|
|
2 files changed, 19 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/group.master b/group.master
|
|
index ad1dd2d..5ab0d52 100644
|
|
--- a/group.master
|
|
+++ b/group.master
|
|
@@ -1,15 +1,11 @@
|
|
root:*:0:
|
|
-daemon:*:1:
|
|
-bin:*:2:
|
|
sys:*:3:
|
|
adm:*:4:
|
|
tty:*:5:
|
|
disk:*:6:
|
|
-lp:*:7:
|
|
mail:*:8:
|
|
news:*:9:
|
|
uucp:*:10:
|
|
-man:*:12:
|
|
proxy:*:13:
|
|
kmem:*:15:
|
|
dialout:*:20:
|
|
@@ -19,7 +15,6 @@ cdrom:*:24:
|
|
floppy:*:25:
|
|
tape:*:26:
|
|
sudo:*:27:
|
|
-audio:*:29:
|
|
dip:*:30:
|
|
www-data:*:33:
|
|
backup:*:34:
|
|
@@ -30,10 +25,18 @@ src:*:40:
|
|
gnats:*:41:
|
|
shadow:*:42:
|
|
utmp:*:43:
|
|
-video:*:44:
|
|
sasl:*:45:
|
|
plugdev:*:46:
|
|
staff:*:50:
|
|
-games:*:60:
|
|
users:*:100:
|
|
nogroup:*:65534:
|
|
+nova:*:162:nova
|
|
+neutron:*:164:neutron
|
|
+ceilometer:*:166:ceilometer
|
|
+sysinv:*:168:sysinv
|
|
+snmpd:*:169:snmpd,fm
|
|
+fm:*:195:fm
|
|
+libvirt:*:991:nova
|
|
+ironic:*:1874:ironic
|
|
+www:*:1877:www
|
|
+keystone:*:42424:keystone
|
|
diff --git a/passwd.master b/passwd.master
|
|
index f1e69a4..c3a3ebc 100644
|
|
--- a/passwd.master
|
|
+++ b/passwd.master
|
|
@@ -1,12 +1,7 @@
|
|
root:*:0:0:root:/root:/bin/bash
|
|
-daemon:*:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
-bin:*:2:2:bin:/bin:/usr/sbin/nologin
|
|
sys:*:3:3:sys:/dev:/usr/sbin/nologin
|
|
sync:*:4:65534:sync:/bin:/bin/sync
|
|
-games:*:5:60:games:/usr/games:/usr/sbin/nologin
|
|
man:*:6:12:man:/var/cache/man:/usr/sbin/nologin
|
|
-lp:*:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
|
|
-mail:*:8:8:mail:/var/mail:/usr/sbin/nologin
|
|
news:*:9:9:news:/var/spool/news:/usr/sbin/nologin
|
|
uucp:*:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
|
|
proxy:*:13:13:proxy:/bin:/usr/sbin/nologin
|
|
@@ -16,3 +11,12 @@ list:*:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
|
|
irc:*:39:39:ircd:/run/ircd:/usr/sbin/nologin
|
|
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
|
|
nobody:*:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
|
|
+neutron:*:164:164:OpenStack Neutron Daemons:/var/lib/neutron:/sbin/nologin
|
|
+sysinv:*:168:168:sysinv Daemons:/var/lib/sysinv:/sbin/nologin
|
|
+snmpd:*:169:169:net-snmp:/usr/share/snmp:/sbin/nologin
|
|
+fm:*:195:195:fm-mgr:/var/lib/fm:/sbin/nologin
|
|
+ceilometer:*:991:166:OpenStack ceilometer Daemons:/var/lib/ceilometer:/sbin/nologin
|
|
+nova:*:994:162:OpenStack Nova Daemons:/var/lib/nova:/sbin/nologin
|
|
+ironic:*:1874:1874:OpenStack Ironic Daemons:/var/lib/ironic:/sbin/nologin
|
|
+www:*:1877:1877:www:/home/www:/sbin/nologin
|
|
+keystone:*:42424:42424:OpenStack Keystone Daemons:/var/lib/keystone:/sbin/nologin
|
|
--
|
|
2.17.1
|
|
|