Ensure there are no system 'default group' writable files (objects)

Cómo se verifica

Método de auditoría: Comando de shell

command -v lsgroup >/dev/null 2>&1 || exit 1; out=$( { for grp in $(lsgroup -a admin ALL | awk '$2=="admin=true"{print $1}'); do find / \( -fstype jfs -o -fstype jfs2 \) ! -type d -perm -g+w -group "$grp" -print; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Review the currently mounted local filesystems using the following to find all world writable files on local JFS/JFS2 filesystems only: Note: the list generated by the command below is for all groups, not just the default system groups. the command without the argument -ls will create a list than can be fed to /usr/bin/xargs to blindly remove the group write permissions. find -L / \( -fstype jfs -o -fstype jfs2 \) -type f -perm -g+w -ls Remedy any files in the list, e.g., chmod g-w {filename} Document any files, and motivate why they are group writeable, and also add documentation re: when/why this exception ceases.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aix --level 2