Ensure the KDC database and master key stash are accessible only by root

KritisLevel 1Otomatiskerberos

Deskripsi

The principal database and the stash file (.k5.<REALM>) together expose every long-term key in the realm. The audit inspects the KDC state directory (/var/lib/krb5kdc on Debian/Ubuntu, /var/kerberos/krb5kdc on RHEL) and fails if any principal* or .k5.* file has group or other permissions or is not owned by root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

n=0
for d in /var/lib/krb5kdc /var/kerberos/krb5kdc; do
  [ -d "$d" ] || continue
  n=$((n+1))
  bad=$(find "$d" -maxdepth 1 -type f \( -name 'principal*' -o -name '.k5.*' \) \( -perm /077 -o ! -user root \) 2>/dev/null) || exit 1
  [ -z "$bad" ] || { printf '%s\n' "$bad"; exit 1; }
done
[ "$n" -gt 0 ] && echo compliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Perintah shell

shell

for d in /var/lib/krb5kdc /var/kerberos/krb5kdc; do if [ -d "$d" ]; then find "$d" -maxdepth 1 -type f \( -name 'principal*' -o -name '.k5.*' \) -exec chown root:root {} + -exec chmod 600 {} + || exit 1; fi; done

Properti

Sistem operasi: Apa saja
Tag: kerberoskdcpermissionskeys
Referensi: CIS MIT Kerberos / Linux Benchmark guidance - KDC database and stash file protection (verify section number for your release)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target kerberos