Ensure local interactive user dot files access is configured

中レベル 1手動レビューaix

説明

USER configuration files in their respective HOME directory e.g. $HOME/.profile, should only be accessible to the owner aka UID of the file. Write access to USER or account configuration files may enable malicious users to steal or modify other user's data, or to gain elevated privileges while read access may reveal secrets.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Validate the permissions of all user configuration files: lsuser -a home ALL |cut -f2 -d= |egrep -v "^/$|/etc|/bin|/var|/usr|/usr/sys" |while read homedir; do if [[ -d ${homedir} ]]; then echo "Listing all user confguration files in '${homedir}'" ls -a ${homedir} |egrep "^\.[a-z]" |while read file; do if [[ -f "${homedir}/${file}" ]]; then ls -l "${homedir}/${file}" fi done else echo "ERROR - no home directory for '${homedir}'" fi done

修正方法

修正方法: ガイダンスまたは IaC パッチ

Search and remediate any user configuration files which have group or world writable access: lsuser -a home ALL |cut -f2 -d= |egrep -v "^/$|/etc|/bin|/var|/usr|/usr/sys" |while read homedir; do if [[ -d ${homedir} ]]; then echo "Removing 'go-w' from all user confguration files in '${homedir}'" ls -a ${homedir} |egrep "^\.[a-z]" |while read file; do if [[ -f "${homedir}/${file}" ]]; then echo "Running 'chmod go-w' on '${homedir}/${file}'" chmod go-w "${homedir}/${file}" fi done else echo "ERROR - no home directory for '${homedir}'" fi done NOTE: The permission change is automatically applied

プロパティ

オペレーティングシステム: すべて
タグ: aixaccounts
参照: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.1.18 Ensure local interactive user dot files access is configured