TMA-NGINX-2.2.3
Ensure the NGINX service account has an invalid shell
MittelStufe 1Automatisiertnginx
Beschreibung
The NGINX service account must be configured with an invalid login shell to prevent interactive access. Reads the account from the user directive; its login shell must be nologin or false. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; sh=$(getent passwd "$u" | cut -d: -f7) || exit 1; case "$sh" in */nologin|/bin/false|/usr/bin/false) echo compliant;; *) echo noncompliant;; esac- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
usermod -s /sbin/nologin <nginx user> (use /usr/sbin/nologin on Debian/Ubuntu).
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- nginxaccounts
- Referenz
- CIS NGINX Benchmark v3.0.0 - 2.2.3 Ensure the NGINX service account has an invalid shell
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target nginx