Ensure that NGINX is run using a non-privileged, dedicated service account

ÉlevéeNiveau 1Automatiséenginx

Description

The NGINX master process typically runs as root to bind to privileged ports and manage resources, but it spawns worker processes to handle the actual client traffic. The user directive in the main configuration designates the operating system account under which these worker processes run. Compliant when the user directive names an account whose UID is not 0 and which is not in the root, wheel, sudo or admin groups (sudo rights are not checked). Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; id=$(id -u "$u" 2>/dev/null) || { echo noncompliant; exit 0; }; g=$(id -Gn "$u" 2>/dev/null); [ "$id" != 0 ] && ! printf ' %s ' "$g" | grep -Eq ' (root|wheel|sudo|admin) ' && echo compliant || echo noncompliant

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Create a dedicated system account (e.g. useradd -r -s /sbin/nologin nginx), set 'user nginx;' in the main context of nginx.conf and remove the account from privileged groups. Then run nginx -t and reload nginx.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: nginxaccounts
Référence: CIS NGINX Benchmark v3.0.0 - 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target nginx