TMA-FREEBSD-6.2.9
Ensure root is the only UID 0 account
CritiqueNiveau 1Automatiséefreebsd
Description
Any account with UID 0 has superuser privileges on the system. This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism, as noted in Item 4.3.7 Ensure access to the su command is restricted. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
Méthode de vérification
Méthode d'audit: Commande shell
shell
command -v awk >/dev/null 2>&1 || exit 1; out=$( { awk -F: '($3 == 0 && $1 != "root") { print $1 }' /etc/passwd ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Sortie attendue
compliant
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Remove any users other than root with UID 0 or assign them a new UID if appropriate.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- freebsdaccounts
- Référence
- CIS FreeBSD 14 Benchmark v1.0.1 - 6.2.9 Ensure root is the only UID 0 account
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
shell
tmaegis scan --target freebsd