Ensure all directories in root PATH access are configured

Méthode de vérification

Méthode d'audit: Commande shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; IFS=:; set -- $p; unset IFS; for d in "$@"; do case "$d" in "") r="empty entry (current directory) in PATH";; /*) if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || ($3!="root" && $3!="bin") {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; else r="non-existent directory $d in PATH"; fi;; *) r="relative directory $d in PATH";; esac; done; echo "$r"

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Search and report on group or world writable directories in root's PATH. The command must be run as the root user. The script below traverses up each individual directory PATH, ensuring that all directories are not group/world writable and that they are owned by root or the bin user: echo "/:${PATH}" | tr ':' '\n' | grep "^/" | sort -u | while read DIR do DIR=${DIR:-$(pwd)} print "Checking ${DIR}" while [[ -d ${DIR} ]] do [[ "$(ls -ld ${DIR})" = @(d???????w? *) ]] && print " WARNING ${DIR} is world writable" || print " ${DIR} is not world writable" [[ "$(ls -ld ${DIR})" = @(d????w???? *) ]] && print " WARNING ${DIR} is group writable" || print " ${DIR} is not group writable" [[ "$(ls -ld ${DIR} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${DIR} is not owned by root or bin" DIR=${DIR%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable are marked with "WARNING" To manually change permissions on the directories: To remove group writable access: chmod g-w <dir name> To remove world writable access: chmod o-w <dir name> To remove both group and world ... (see CIS section 4.1.2.10)

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target aix