Ensure nologin is not listed in /etc/shells

BajaNivel 2Automatizadalinux

Descripción

/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs. Be aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps '"'"'^\h*([^#\n\r]+)?\/nologin\b'"'"' /etc/shells' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit /etc/shells and remove any lines that include nologin

Propiedades

Sistemas operativos: sles-15
Etiquetas: cis-convertedlinux
Referencia: CIS SUSE Linux Enterprise 15 Benchmark v2.0.1 - 5.4.3.1

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2