TMA-NGINX-2.2.3
Ensure the NGINX service account has an invalid shell
SedangLevel 1Otomatisnginx
Deskripsi
The NGINX service account must be configured with an invalid login shell to prevent interactive access. Reads the account from the user directive; its login shell must be nologin or false. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.
Cara pemeriksaan
Metode audit: Perintah shell
shell
out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; sh=$(getent passwd "$u" | cut -d: -f7) || exit 1; case "$sh" in */nologin|/bin/false|/usr/bin/false) echo compliant;; *) echo noncompliant;; esac- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
usermod -s /sbin/nologin <nginx user> (use /usr/sbin/nologin on Debian/Ubuntu).
Properti
- Sistem operasi
- Apa saja
- Tag
- nginxaccounts
- Referensi
- CIS NGINX Benchmark v3.0.0 - 2.2.3 Ensure the NGINX service account has an invalid shell
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
shell
tmaegis scan --target nginx