Ensure that NGINX is run using a non-privileged, dedicated service account

TinggiLevel 1Otomatisnginx

Deskripsi

The NGINX master process typically runs as root to bind to privileged ports and manage resources, but it spawns worker processes to handle the actual client traffic. The user directive in the main configuration designates the operating system account under which these worker processes run. Compliant when the user directive names an account whose UID is not 0 and which is not in the root, wheel, sudo or admin groups (sudo rights are not checked). Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; id=$(id -u "$u" 2>/dev/null) || { echo noncompliant; exit 0; }; g=$(id -Gn "$u" 2>/dev/null); [ "$id" != 0 ] && ! printf ' %s ' "$g" | grep -Eq ' (root|wheel|sudo|admin) ' && echo compliant || echo noncompliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Create a dedicated system account (e.g. useradd -r -s /sbin/nologin nginx), set 'user nginx;' in the main context of nginx.conf and remove the account from privileged groups. Then run nginx -t and reload nginx.

Properti

Sistem operasi: Apa saja
Tag: nginxaccounts
Referensi: CIS NGINX Benchmark v3.0.0 - 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target nginx