Ensure permissions on /etc/shells are configured

MediaNivel 1Automatizadafreebsd

Descripción

/etc/shells is a text file that contains the full pathnames of valid login shells. This file is consulted by chsh and is available to be queried by other programs. It is critical to protect the /etc/shells file from unauthorized access. Although it is protected by default, the file permissions could be changed inadvertently or through malicious actions. Audit: compares `ls -ld` mode (this mode or more restrictive), owner and group with the CIS values.

Cómo se verifica

Método de auditoría: Comando de shell

shell

r=compliant; for f in /etc/shells; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r--r--' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; echo "$r"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following commands to remove excess permissions, set owner, and set group on /etc/shells: # chmod u-x,go-wx /etc/shells # chown root:wheel /etc/shells

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: freebsdpermissions
Referencia: CIS FreeBSD 14 Benchmark v1.0.1 - 6.1.4 Ensure permissions on /etc/shells are configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target freebsd