TMA-COS-1.3.1
Ensure authentication required for single user mode
MediaNivel 1Automatizadacos
Descripción
Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader. Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.
Cómo se verifica
Método de auditoría: Comando de shell
shell
alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue' || { echo step1: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency' || { echo step2: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'; return 1; }; }; if alt0; then echo compliant; fi- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- authcontainer-optimized-oscos
- Referencia
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.3.1 Ensure authentication required for single user mode
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target cos