Ensure world writable files and directories are secured

Cómo se verifica

Método de auditoría: Comando de shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -path /tmp -o -path /proc \) -prune -o -type f -perm -o=w -print; find / \( -path /tmp -o -path /proc \) -prune -o -type d -perm -o=w ! -perm -1000 -print ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: Remove other write permission from any world writable files Add the sticky bit to all world writable directories #!/bin/sh # Define paths to exclude (space-separated) a_path_exclusions="! -path '/tmp/*' ! -path '/proc/*'" # Fix world-writable files by removing the write permission for "others" find / \( $a_path_exclusions \) -type f -perm -o=w -print -exec chmod o-w {} \; # Fix world-writable directories without the sticky bit find / \( $a_path_exclusions \) -type d -perm -o=w ! -perm -1000 -print -exec chmod +t,o-w {} \;

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target freebsd