Marcus Burghardt

FYI @ComplianceAsCode/ubuntu-maintainers @ComplianceAsCode/suse-maintainers @ComplianceAsCode/oracle-maintainers

@Xeicker , could you also review, please? It also needs approval from @ComplianceAsCode/oracle-maintainers .

Hi @mildas , is this PR still necessary?

@neutronscott would you like to propose a PR to improve this? I would be happy to review it.

It is likely related to https://github.com/ComplianceAsCode/content/pull/11729

It seems fixed by https://github.com/ComplianceAsCode/content/pull/11890

Currently this is the relevant line in OVAL: `^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$`

> IIUC using `/bin/false` will also prevent the user from login but `/sbin/nologin` will also display a message to the user that tries to login. I would say that for...

I am preparing the fix to restrict the list of shells in this OVAL. However, we should still talk to DISA so they can extend the check on their side...

> pam_unix.so We can safely update this to use 65536 with sha512.