{{{ oval_metadata(" SAP system users sidadm/sapadm and orasid/oracle should be the only users besides the authorized usrs listed in var_accounts_authorized_local_users_regex that exist locally on the operating system. Limitation: only works with zero to one SAP system on each OS/VM. ") }}}
/etc/passwd
^([a-zA-Z0-9_.-]+?):
1
filter_default_os_user
filter_sidadm_sapadm_orasid_oracle_users
root
^([a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|oracle)$
/etc/passwd
^([a-z][a-z0-9][a-z0-9])adm:
1
filter_sapadm_user
sap
^/sapmnt/[A-Z][A-Z0-9][A-Z0-9]$
/etc/passwd
^(sapadm):
1
/usr/sap/hostctrl
/etc/passwd
^ora([a-z][a-z0-9][a-z0-9]):
1
filter_oracle_user
cle
^/sapmnt/[A-Z][A-Z0-9][A-Z0-9]/exe/(|(|n)uc/[A-Za-z0-9_]+/)brspace$
/etc/passwd
^oracle:x:([\d]+)
1
^/oracle/[A-Z][A-Z0-9][A-Z0-9]$
^/sapmnt/[A-Z][A-Z0-9][A-Z0-9]/exe/(|(|n)uc/[A-Za-z0-9_]+/)brspace$