Ensure access to /var/spool/clientmqueue is configured

보통레벨 1자동aix

설명

The recommended DAC (discretionary access control) settings for the /var/spool/clientmqueue directory are applied. Queued messages are the messages that have not yet reached their final destination. To ensure the integrity of the messages during storage, the mail queue directory must be secured from unauthorized access. Audit: compares `ls -ld` mode (this mode or more restrictive), owner and group with the CIS values; ACLs are not evaluated.

점검 방법

감사 방식: 셸 명령

shell

r=compliant; for f in /var/spool/clientmqueue/; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rwxrwx---' -v o='smmsp' -v g='smmsp' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; echo "$r"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set the recommended permissions and ownership on /var/spool/mqueue: chmod ug=rwx,o= /var/spool/clientmqueue chown smmsp.smmsp /var/spool/clientmqueue

속성

운영 체제: 모두
태그: aixpermissions
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.4.4 Ensure access to /var/spool/clientmqueue is configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix