TMA-AIX-3.3

Ensure there are no system 'default group' writable files (objects)

보통레벨 2자동aix

설명

The system is audited for group writable files that belong to one of the default AIX groups. An audit should be performed on the system to search for the presence of group writable files and devices. (Directories are covered in a seperate recommendation). Audit: finds objects writable by any administrative (admin=true) group on local JFS/JFS2 filesystems.

점검 방법

감사 방식: 셸 명령

shell

command -v lsgroup >/dev/null 2>&1 || exit 1; out=$( { for grp in $(lsgroup -a admin ALL | awk '$2=="admin=true"{print $1}'); do find / \( -fstype jfs -o -fstype jfs2 \) ! -type d -perm -g+w -group "$grp" -print; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Review the currently mounted local filesystems using the following to find all world writable files on local JFS/JFS2 filesystems only: Note: the list generated by the command below is for all groups, not just the default system groups. the command without the argument -ls will create a list than can be fed to /usr/bin/xargs to blindly remove the group write permissions. find -L / \( -fstype jfs -o -fstype jfs2 \) -type f -perm -g+w -ls Remedy any files in the list, e.g., chmod g-w {filename} Document any files, and motivate why they are group writeable, and also add documentation re: when/why this exception ceases.

속성

운영 체제: 모두
태그: aixaccounts
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 3.3 Ensure there are no system 'default group' writable files (objects)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix --level 2