Ensure local interactive user home directories are configured

MediaNivel 1Automatizadalinux

Descripción

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask )) )"
   while IFS=" " read -r l_user l_home; do
      if [ ! -d "$l_home" ]; then
         printf '"'"'%s\n'"'"' " - User: \"$l_user\" home directory \"$l_home\" does not exist"
      else
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is owned by \"$l_own\" (should be owned by \"$l_user\")"
            [ $(( $l_mode & $l_mask )) -gt 0 ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is mode \"$l_mode\" (should be \"$l_max\" or more restrictive)"
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. If a local interactive user's home directory is undefined and/or does not exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If the home directory is undefined, set it to the absolute path of that directory: # usermod --home <directory> <username> 2. For each existing home directory reported by the Audit Procedure, make changes in accordance with local site policy and apply the corresponding action: • The directory is not owned by its user - set the owner: # chown <user> <home_directory> • The directory is more permissive than mode 0750 - remove the excess permissions: # chmod g-w,o…

Propiedades

Sistemas operativos: rhel-9
Etiquetas: cis-convertedlinux
Referencia: CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 7.2.8

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux