TMA-BIND-2.6
Set Group named or root for BIND Directories and Files
Deskripsi
All the BIND directories and files should have a group of either named or root. The audit lists files and directories under $BIND_HOME and $RUNDIR whose group is not root or named (bind on Debian) and requires none. $BIND_HOME is taken as the existing ones of /var/named (RHEL, including a chroot), /etc/bind and /var/cache/bind (Debian/Ubuntu) and $RUNDIR as /run/named; the runtime directories (dynamic, slaves, data, run, log, tmp, /var/cache/bind) are excluded where the benchmark excludes them.
Cara pemeriksaan
Metode audit: Perintah shell
BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
out=$(find $BH $RUN \! \( $G \) -print 2>/dev/null) || exit 1
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out" | head -n 20; echo 'files or directories with a group other than root/named'; }- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Run the command below to change all BIND directories and files to the group named. chgrp -R named $BIND_HOME $RUNDIR
Properti
- Sistem operasi
- Apa saja
- Tag
- binddnspermissions
- Referensi
- CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 2.6 Set Group named or root for BIND Directories and Files
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target bind