TMA-NGINX-2.2.3
Ensure the NGINX service account has an invalid shell
MediaNivel 1Automatizadanginx
Descripción
The NGINX service account must be configured with an invalid login shell to prevent interactive access. Reads the account from the user directive; its login shell must be nologin or false. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.
Cómo se verifica
Método de auditoría: Comando de shell
shell
out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; sh=$(getent passwd "$u" | cut -d: -f7) || exit 1; case "$sh" in */nologin|/bin/false|/usr/bin/false) echo compliant;; *) echo noncompliant;; esac- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
usermod -s /sbin/nologin <nginx user> (use /usr/sbin/nologin on Debian/Ubuntu).
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- nginxaccounts
- Referencia
- CIS NGINX Benchmark v3.0.0 - 2.2.3 Ensure the NGINX service account has an invalid shell
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target nginx