Puppet Class: cis_security_hardening::rules::restrict_su

Defined in:
manifests/rules/restrict_su.pp

Summary

Ensure access to the su command is restricted

Overview

The su command allows a user to run a command or shell as another user. The program has been superseded by sudo , which allows for more granular control over privileged access. Normally, the su command can be executed by any user. By uncommenting the pam_wheel.so statement in /etc/pam.d/su , the su command will only allow users in the wheel group to execute su.

Rationale: Restricting the use of su , and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo , whereas su can only record that a user executed the su program.

Examples:

class { 'cis_security_hardening::rules::restrict_su':
    enforce => true,
    wheel_users => ['root'],
}

Parameters:

  • enforce (Boolean) (defaults to: false) —

    Enforce the rule

  • wheel_users (Array) (defaults to: ['root']) —

    Users to be added to the wheel group.

  • sudo_group (Cis_security_hardening::Word) (defaults to: 'wheel') —

    Group for sudo



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'manifests/rules/restrict_su.pp', line 31

class cis_security_hardening::rules::restrict_su (
  Boolean $enforce                         = false,
  Array $wheel_users                       = ['root'],
  Cis_security_hardening::Word $sudo_group = 'wheel',
) {
  if($enforce) {
    if $facts['os']['family'].downcase() == 'redhat'and $facts['os']['release']['major'] >= '9' {
      $args = ['use_uid']
    } else {
      $args = ['use_uid',"group=${sudo_group}"]
    }
    Pam { 'pam-su-restrict':
      ensure    => present,
      service   => 'su',
      type      => 'auth',
      control   => 'required',
      module    => 'pam_wheel.so',
      arguments => $args,
    }

    group { $sudo_group:
      ensure => present,
    }

    $wheel_users.each | $user | {
      unless $sudo_group =~ /^[0-9a-zA-Z\_]+$/ {
        fail("Illegal sudo group: ${sudo_group}")
      }
      unless $user =~ /^[0-9a-zA-Z\_]+$/ {
        fail("Illegal sudo group: ${user}")
      }

      exec { "${user}_wheel":
        command => "usermod -G ${sudo_group} ${user}",  #lint:ignore:security_class_or_define_parameter_in_exec
        unless  => "grep ${sudo_group} /etc/group | grep ${user}",
        path    => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
      }
    }
  }
}