Ensure world writable files and directories are secured

高レベル 1自動freebsd

説明

World writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the chmod(2) man page for more information. Audit: no world-writable files, and no world-writable directories without the sticky bit (outside /tmp and /proc); long running.

チェック方法

監査方法: シェルコマンド

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -path /tmp -o -path /proc \) -prune -o -type f -perm -o=w -print; find / \( -path /tmp -o -path /proc \) -prune -o -type d -perm -o=w ! -perm -1000 -print ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: Remove other write permission from any world writable files Add the sticky bit to all world writable directories #!/bin/sh # Define paths to exclude (space-separated) a_path_exclusions="! -path '/tmp/*' ! -path '/proc/*'" # Fix world-writable files by removing the write permission for "others" find / $ $a_path_exclusions $ -type f -perm -o=w -print -exec chmod o-w {} \; # Fix world-writable directories without the sticky bit find / $ $a_path_exclusions $ -type d -perm -o=w ! -perm -1000 -print -exec chmod +t,o-w {} \;

プロパティ

オペレーティングシステム: すべて
タグ: freebsdpermissions
参照: CIS FreeBSD 14 Benchmark v1.0.1 - 6.1.5 Ensure world writable files and directories are secured

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target freebsd