Disable "nobody" Access for RPC Encryption Key Storage Service

AltaNivel 1Automatizadasolaris

Descripción

This action listed prevents keyserv from using default keys for the nobody user, effectively stopping the nobody user from accessing information via Secure RPC. If login by the user nobody is allowed for secure RPC, there is an increased risk of system compromise. Audit: compliant when keyserv is not installed.

Cómo se verifica

Método de auditoría: Comando de shell

shell

f=/etc/default/keyserv; [ -f "$f" ] || { echo compliant; exit 0; }; grep -q "^ENABLE_NOBODY_KEYS=NO" "$f" && echo compliant || echo "ENABLE_NOBODY_KEYS is not NO"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Perform the following to implement the recommended state: # cd /etc/default # cp keyserv keyserv.orig # awk '/ENABLE_NOBODY_KEYS=/ { $1 = "ENABLE_NOBODY_KEYS=NO" } { print }' keyserv > keyserv.CIS # mv keyserv.CIS keyserv

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: solarisnetwork
Referencia: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.14 Disable "nobody" Access for RPC Encryption Key Storage Service

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target solaris