Ensure access on root user smit.log is configured

ÉlevéeNiveau 1Automatiséeaix

Description

The smit.log file int the HOME directory of root maintains a history of all smit commands run as root. The smit.log file may contain sensitive information regarding system configuration, which may be of interest to an attacker. This log file must be secured from unauthorized access and modifications. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v lsuser >/dev/null 2>&1 || exit 1; h=$(lsuser -a home root 2>/dev/null | sed -n "s/.*home=//p"); [ -n "$h" ] || exit 1; r=compliant; for f in "${h%/}/smit.log"; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='' -v g='' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else :; fi; done; echo "$r"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Remove world read and write access to the root user's smit.log: HOME=~root if (test ${HOME} != "/") then HOME=${HOME}/ fi chmod u=rw,g=r,o-rwx ${HOME}smit.log chown root:system ${HOME}smit.log

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aixaudit
Référence: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.1.1 Ensure access on root user smit.log is configured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target aix