Ensure all directories in root PATH access are configured

Cara pemeriksaan

Metode audit: Perintah shell

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; IFS=:; set -- $p; unset IFS; for d in "$@"; do case "$d" in "") r="empty entry (current directory) in PATH";; /*) if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || ($3!="root" && $3!="bin") {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; else r="non-existent directory $d in PATH"; fi;; *) r="relative directory $d in PATH";; esac; done; echo "$r"

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Search and report on group or world writable directories in root's PATH. The command must be run as the root user. The script below traverses up each individual directory PATH, ensuring that all directories are not group/world writable and that they are owned by root or the bin user: echo "/:${PATH}" | tr ':' '\n' | grep "^/" | sort -u | while read DIR do DIR=${DIR:-$(pwd)} print "Checking ${DIR}" while [[ -d ${DIR} ]] do [[ "$(ls -ld ${DIR})" = @(d???????w? *) ]] && print " WARNING ${DIR} is world writable" || print " ${DIR} is not world writable" [[ "$(ls -ld ${DIR})" = @(d????w???? *) ]] && print " WARNING ${DIR} is group writable" || print " ${DIR} is not group writable" [[ "$(ls -ld ${DIR} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${DIR} is not owned by root or bin" DIR=${DIR%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable are marked with "WARNING" To manually change permissions on the directories: To remove group writable access: chmod g-w <dir name> To remove world writable access: chmod o-w <dir name> To remove both group and world ... (see CIS section 4.1.2.10)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target aix