Ensure local interactive user dot files access is configured

보통레벨 1수동 검토aix

설명

USER configuration files in their respective HOME directory e.g. $HOME/.profile, should only be accessible to the owner aka UID of the file. Write access to USER or account configuration files may enable malicious users to steal or modify other user's data, or to gain elevated privileges while read access may reveal secrets.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Validate the permissions of all user configuration files: lsuser -a home ALL |cut -f2 -d= |egrep -v "^/$|/etc|/bin|/var|/usr|/usr/sys" |while read homedir; do if [[ -d ${homedir} ]]; then echo "Listing all user confguration files in '${homedir}'" ls -a ${homedir} |egrep "^\.[a-z]" |while read file; do if [[ -f "${homedir}/${file}" ]]; then ls -l "${homedir}/${file}" fi done else echo "ERROR - no home directory for '${homedir}'" fi done

조치 방법

조치 방식: 가이드 또는 인프라 패치

Search and remediate any user configuration files which have group or world writable access: lsuser -a home ALL |cut -f2 -d= |egrep -v "^/$|/etc|/bin|/var|/usr|/usr/sys" |while read homedir; do if [[ -d ${homedir} ]]; then echo "Removing 'go-w' from all user confguration files in '${homedir}'" ls -a ${homedir} |egrep "^\.[a-z]" |while read file; do if [[ -f "${homedir}/${file}" ]]; then echo "Running 'chmod go-w' on '${homedir}/${file}'" chmod go-w "${homedir}/${file}" fi done else echo "ERROR - no home directory for '${homedir}'" fi done NOTE: The permission change is automatically applied

속성

운영 체제: 모두
태그: aixaccounts
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.1.18 Ensure local interactive user dot files access is configured