Ensure root path integrity

HighLevel 1Automatedfreebsd

Description

The root user can execute any command on the system and could be fooled into executing programs unintentionally if the PATH is not set correctly. Including the current working directory (.) or other writable directory in root's executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as root to execute a Trojan horse program. Audit: root's login PATH must not contain ::, a trailing :, '.', non-directories, or directories not owned by root or writable by group/other.

How it is checked

Audit method: Shell command

shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; case "$p" in *::*) r="PATH contains an empty directory (::)";; *:) r="PATH has a trailing :";; esac; IFS=:; set -- $p; unset IFS; for d in "$@"; do [ "$d" = . ] && r="PATH contains ."; if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || $3!="root" {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; elif [ -n "$d" ]; then r="$d is not a directory"; fi; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Correct or justify any: Locations that are not directories Empty directories (::) Trailing (:) Current working directory (.) Non root owned directories Directories that less restrictive than mode 0755

Properties

Operating systems: Any
Tags: freebsdaccounts
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 6.2.8 Ensure root path integrity

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd