I'm familiar with some of the more common ways of configuring a Linux server to be compliant with PCI-DSS 3.2, at least to the requirements of SAQ A. A common concern is requirement 8.5 which requires that:
Generic user IDs and accounts are disabled or removed
This includes the root user, which obviously cannot be disabled, so a "compensating control" (in the terminology of PCI-DSS) is needed. A common recipe is some variant of the following:
- disable logins as root;
- require logins by
ssh
to use an SSH key; - use
sudo
to get root; - install
pam_loginuid
to record the login user ID once users have root; and - install and configure
auditd
to record root actions and the login user ID.
However in case I'm dealing with today, it's not a single machine I'm securing: it's a small cluster (currently with 10 machines), and it's really, really useful to be able to ssh
(and scp
files) between the machines. Having to do that as a non-root user would be a real pain: almost always the file you need is only readable to root and needs to be put some place only root can write to.
What I'd like to do is allow ssh
as root between the machines, using a SSH key present on the servers. This is easy enough in /etc/ssh/sshd_config
with a PermitRootLogin
command in a Match Address
block. I'm not too concerned about the security implications of allowing someone who has compromised one machine to gain control of the whole cluster: the machines are similar enough that if they manage to compromise one, they can probably use the same process to access the rest.
However if I do this, I loose the ability to track who is running what command, as the no login UID is no longer attached to the process when I ssh
to another machine. A compensating control in PCI-DSS needs to "meet the intent and rigor of the original PCI DSS requirement", and the intent of requirement 8.5 is stated as being to make it possible "to trace system access and activities to an individual". Without preserving the login UID, we're no longer providing a compensating control for allowing the root user to exist.
What I'm hoping to find is way of passing loginuid from server to server when login in as root, probably by putting it into the environment. I don't mind that this requires implicitly trusting the originating server: it already is. Can anyone suggest a means of doing this? Or failing that, another way of tracing sysadmin activity as root to a particular user, while allowing easy ssh
and scp
between machines?