TMA-COS-6.1.1

Ensure permissions on /etc/passwd are configured

MediaNivel 1Automatizadacos

Descripción

The /etc/passwd file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate. It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat /etc/passwd' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to set permissions on /etc/passwd : # chown root:root /etc/passwd # chmod 644 /etc/passwd

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: access-controlcontainer-optimized-oscos
Referencia: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.1.1 Ensure permissions on /etc/passwd are configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cos