TMA-SOLARIS-2.7
Disable Kerberos TGT Expiration Warning
BajaNivel 1Automatizadasolaris
Descripción
The Kerberos TGT warning service is used to warn users when their Kerberos tickets are about to expire or to renew those tickets before they expire. This service is not used if Kerberos has not been configured. This service is configured to be "local only" by default. This service should be disabled if it is not required. Audit: `svcs -Ho state` must report disabled or uninitialized; a service that is not installed is compliant.
Cómo se verifica
Método de auditoría: Comando de shell
shell
command -v svcs >/dev/null 2>&1 || exit 1; r=compliant; for f in svc:/network/security/ktkt_warn; do st=$(svcs -Ho state "$f" 2>/dev/null); case "$st" in ''|disabled|uninitialized) ;; *) r="$f: $st";; esac; done; echo "$r"- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
svcadm disable svc:/network/security/ktkt_warn
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- solarishardening
- Referencia
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 2.7 Disable Kerberos TGT Expiration Warning
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target solaris