documentation_complete: true

prodtype: rhel7,fedora

title: 'Restrict Serial Port Root Logins'

description: |-
    To restrict root logins on serial ports,
    ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
    <pre>ttyS0
    ttyS1</pre>

rationale: |-
    Preventing direct root login to serial port interfaces
    helps ensure accountability for actions taken on the systems
    using the root account.

severity: unknown

identifiers:
    cce@rhel7: 27268-2

references:
    cui: '3.1.1, 3.1.5'
    disa: 770
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    nist: AC-6(2)

ocil_clause: 'root login over serial ports is permitted'

ocil: |-
    To check for serial port entries which permit root login,
    run the following command:
    <pre>$ sudo grep ^ttyS/[0-9] /etc/securetty</pre>
    If any output is returned, then root login over serial ports is permitted.
