TMA-COS-1.3.1
Ensure authentication required for single user mode
MittelStufe 1Automatisiertcos
Beschreibung
Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader. Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue' || { echo step1: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency' || { echo step2: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'; return 1; }; }; if alt0; then echo compliant; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- authcontainer-optimized-oscos
- Referenz
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.3.1 Ensure authentication required for single user mode
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target cos