Ensure world writable files and directories are secured

Méthode de vérification

Méthode d'audit: Commande shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -path /tmp -o -path /proc \) -prune -o -type f -perm -o=w -print; find / \( -path /tmp -o -path /proc \) -prune -o -type d -perm -o=w ! -perm -1000 -print ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: Remove other write permission from any world writable files Add the sticky bit to all world writable directories #!/bin/sh # Define paths to exclude (space-separated) a_path_exclusions="! -path '/tmp/*' ! -path '/proc/*'" # Fix world-writable files by removing the write permission for "others" find / \( $a_path_exclusions \) -type f -perm -o=w -print -exec chmod o-w {} \; # Fix world-writable directories without the sticky bit find / \( $a_path_exclusions \) -type d -perm -o=w ! -perm -1000 -print -exec chmod +t,o-w {} \;

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target freebsd