documentation_complete: true


title: 'Ensure Home Directories are Created for New Users'

description: |-
    All local interactive user accounts, upon creation, should be assigned a home directory.
    <br /><br />
    Configure the operating system to assign home directories to all new local interactive users by setting the <tt>CREATE_HOME</tt>
    parameter in <tt>{{{ login_defs_path }}}</tt> to <tt>yes</tt> as follows:
    <br /><br />
    <pre>CREATE_HOME yes</pre>

rationale: |-
    If local interactive users are not assigned a valid home directory, there is no place
    for the storage and control of files they should own.

severity: medium

identifiers:
    cce@rhel8: CCE-83789-8
    cce@rhel9: CCE-88983-2
    cce@rhel10: CCE-88604-4
    cce@sle12: CCE-83053-9
    cce@sle15: CCE-85562-7
    cce@slmicro5: CCE-93736-7
    cce@slmicro6: CCE-95044-4

references:
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-020610
    stigid@ol8: OL08-00-010760
    stigid@sle12: SLES-12-010720
    stigid@sle15: SLES-15-020110

ocil_clause: 'the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out'

ocil: |-
    Verify all local interactive users on {{{ full_name }}} are assigned a home
    directory upon creation with the following command:
    <pre>$ grep -i create_home {{{ login_defs_path }}}</pre>
    <pre>CREATE_HOME yes</pre>

fixtext: |-
    Configure {{{ full_name }}} to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "{{{ login_defs_path }}}" to "yes" as follows.

    CREATE_HOME yes

srg_requirement: "All {{{ full_name }}} local interactive user accounts must be assigned a home directory upon creation."

platform: package[shadow-utils] and system_with_kernel
