Ensure keytab files are owned by root and accessible only by their owner

AltaNivel 1Automatizadakerberos

Descripción

Keytabs contain long-term service keys usable to impersonate the service or decrypt its tickets. Checks /etc/krb5.keytab and the kadmind keytab (/etc/krb5kdc/kadm5.keytab or /var/kerberos/krb5kdc/kadm5.keytab): each existing file must be owned by root with no group or other permissions.

Cómo se verifica

Método de auditoría: Comando de shell

shell

n=0; bad=0
for f in /etc/krb5.keytab /etc/krb5kdc/kadm5.keytab /var/kerberos/krb5kdc/kadm5.keytab; do
  [ -f "$f" ] || continue
  n=$((n+1))
  o=$(stat -Lc %U "$f") || exit 1
  [ "$o" = root ] || { echo "$f owned by $o"; bad=1; }
  [ -z "$(find -L "$f" -maxdepth 0 -perm /077)" ] || { echo "$f is accessible by group/other"; bad=1; }
done
[ "$n" -gt 0 ] && [ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

chown root:root <keytab> && chmod 600 <keytab> for each keytab listed. If a non-root service must read a keytab, give it a dedicated per-service keytab (ktutil) owned by that service account with mode 600 instead of opening /etc/krb5.keytab.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: kerberospermissionskeys
Referencia: CIS MIT Kerberos / Linux Benchmark guidance - Keytab file permissions (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target kerberos