Ensure that NGINX is run using a non-privileged, dedicated service account

AltaNivel 1Automatizadanginx

Descripción

The NGINX master process typically runs as root to bind to privileged ports and manage resources, but it spawns worker processes to handle the actual client traffic. The user directive in the main configuration designates the operating system account under which these worker processes run. Compliant when the user directive names an account whose UID is not 0 and which is not in the root, wheel, sudo or admin groups (sudo rights are not checked). Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; id=$(id -u "$u" 2>/dev/null) || { echo noncompliant; exit 0; }; g=$(id -Gn "$u" 2>/dev/null); [ "$id" != 0 ] && ! printf ' %s ' "$g" | grep -Eq ' (root|wheel|sudo|admin) ' && echo compliant || echo noncompliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create a dedicated system account (e.g. useradd -r -s /sbin/nologin nginx), set 'user nginx;' in the main context of nginx.conf and remove the account from privileged groups. Then run nginx -t and reload nginx.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: nginxaccounts
Referencia: CIS NGINX Benchmark v3.0.0 - 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target nginx