Ensure all directories in root PATH access are configured

Cómo se verifica

Método de auditoría: Comando de shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; IFS=:; set -- $p; unset IFS; for d in "$@"; do case "$d" in "") r="empty entry (current directory) in PATH";; /*) if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || ($3!="root" && $3!="bin") {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; else r="non-existent directory $d in PATH"; fi;; *) r="relative directory $d in PATH";; esac; done; echo "$r"

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Search and report on group or world writable directories in root's PATH. The command must be run as the root user. The script below traverses up each individual directory PATH, ensuring that all directories are not group/world writable and that they are owned by root or the bin user: echo "/:${PATH}" | tr ':' '\n' | grep "^/" | sort -u | while read DIR do DIR=${DIR:-$(pwd)} print "Checking ${DIR}" while [[ -d ${DIR} ]] do [[ "$(ls -ld ${DIR})" = @(d???????w? *) ]] && print " WARNING ${DIR} is world writable" || print " ${DIR} is not world writable" [[ "$(ls -ld ${DIR})" = @(d????w???? *) ]] && print " WARNING ${DIR} is group writable" || print " ${DIR} is not group writable" [[ "$(ls -ld ${DIR} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${DIR} is not owned by root or bin" DIR=${DIR%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable are marked with "WARNING" To manually change permissions on the directories: To remove group writable access: chmod g-w <dir name> To remove world writable access: chmod o-w <dir name> To remove both group and world ... (see CIS section 4.1.2.10)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aix