TMA-COS-1.3.1

Ensure authentication required for single user mode

SedangLevel 1Otomatiscos

Deskripsi

Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader. Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue' || { echo step1: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency' || { echo step2: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.

Properti

Sistem operasi: Apa saja
Tag: authcontainer-optimized-oscos
Referensi: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.3.1 Ensure authentication required for single user mode

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cos