Ensure local interactive user home directories are configured

中レベル 1自動linux

説明

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

チェック方法

監査方法: シェルコマンド

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask )) )"
   while IFS=" " read -r l_user l_home; do
      if [ ! -d "$l_home" ]; then
         printf '"'"'%s\n'"'"' " - User: \"$l_user\" home directory \"$l_home\" does not exist"
      else
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is owned by \"$l_own\" (should be owned by \"$l_user\")"
            [ $(( $l_mode & $l_mask )) -gt 0 ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is mode \"$l_mode\" (should be \"$l_max\" or more restrictive)"
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. If a local interactive user's home directory is undefined and/or does not exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If the home directory is undefined, set it to the absolute path of that directory: # usermod --home <directory> <username> 2. For each existing home directory reported by the Audit Procedure, make changes in accordance with local site policy and apply the corresponding action: • The directory is not owned by its user - set the owner: # chown <user> <home_directory> • The directory is more permissive than mode 0750 - remove the excess permissions: # chmod g-w,o…

プロパティ

オペレーティングシステム: rocky-9
タグ: cis-convertedlinux
参照: CIS Rocky Linux 9 Benchmark v3.0.0 - 7.2.8

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux