I'm familiar with some of the more common ways of configuring a Linux server to be compliant with PCI-DSS 3.2, at least to the requirements of SAQ A. A common concern is requirement 8.5 which requires that:
Generic user IDs and accounts are disabled or removed
This includes the root user, which obviously cannot be disabled, so a "compensating control" (in the terminology of PCI-DSS) is needed. A common recipe is some variant of the following:
- disable logins as root;
- require logins by
sshto use an SSH key;
sudoto get root;
pam_loginuidto record the login user ID once users have root; and
- install and configure
auditdto record root actions and the login user ID.
However in case I'm dealing with today, it's not a single machine I'm securing: it's a small cluster (currently with 10 machines), and it's really, really useful to be able to
scp files) between the machines. Having to do that as a non-root user would be a real pain: almost always the file you need is only readable to root and needs to be put some place only root can write to.
What I'd like to do is allow
ssh as root between the machines, using a SSH key present on the servers. This is easy enough in
/etc/ssh/sshd_config with a
PermitRootLogin command in a
Match Address block. I'm not too concerned about the security implications of allowing someone who has compromised one machine to gain control of the whole cluster: the machines are similar enough that if they manage to compromise one, they can probably use the same process to access the rest.
However if I do this, I loose the ability to track who is running what command, as the no login UID is no longer attached to the process when I
ssh to another machine. A compensating control in PCI-DSS needs to "meet the intent and rigor of the original PCI DSS requirement", and the intent of requirement 8.5 is stated as being to make it possible "to trace system access and activities to an individual". Without preserving the login UID, we're no longer providing a compensating control for allowing the root user to exist.
What I'm hoping to find is way of passing loginuid from server to server when login in as root, probably by putting it into the environment. I don't mind that this requires implicitly trusting the originating server: it already is. Can anyone suggest a means of doing this? Or failing that, another way of tracing sysadmin activity as root to a particular user, while allowing easy
scp between machines?