Current criteria to identify local interactive users is based solely on uid range in /etc/login.defs

[prestonSeaman2]

Describe the Issue
Current criteria to identify local interactive users is based solely on uid range in /etc/login.defs. The set of local interactive users should also exclude local user accounts with shell set to /sbin/nologin in /etc/passwd.

Expected Behavior
When performing RHEL-08-020352 task, only local interactive user accounts should be enumerated over.

Actual Behavior
The RHEL-08-020352 task enumerates over other non-local interactive user accounts.

Control(s) Affected
RHEL-08-020352
RHEL-08-010730
RHEL-08-010731
RHEL-08-010740
RHEL-08-010750

Possible Solution
Recommend initializing fact, rhel8stig_passwd_interactive, based on value of rhel8stig_passwd, but with filter applied to exclude entries with /sbin/nologin shell and users with uid >= rhel8stig_interactive_uid_start and <= rhel8stig_interactive_uid_stop. Then, in fix-cat2.yml, replace templated expressions referencing rhel8stig_passwd with rhel8stig_passwd_interactive, for all controls targeting local interactive user accounts.

[uk-bolly]

hi @prestonSeaman2

hi @prestonSeaman2

Thank you for your patience on this issue, with so many moving parts its taken longer than we'd hope. I hopefully have now addressed interactive users issue to work more consistently in a manner that makes sense.
I have created a new branch April_24, which i am hoping to merge into devel soon. If you could possibly confirm this works as you expect?

Many thanks

uk-bolly