Ensure usernames and UIDs are unique

보통레벨 1자동aix

설명

All users should have a unique UID. In particular the only user on the system to have a UID of 0 should be the root user. Likewise, usernames need to be verified as unique. The only user with a UID of 0 on the system must be the root account. Any account (username) with a UID of 0 has super user privileges on the system and becomes root at login. Access to the root account should be via su, sudo or PKI fingerprint. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

점검 방법

감사 방식: 셸 명령

shell

command -v cut >/dev/null 2>&1 || exit 1; out=$( { cut -d: -f3 /etc/passwd | sort -n | uniq -d; cut -d: -f1 /etc/passwd | sort | uniq -d ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Examine the user IDs of all configured accounts: cut -d: -f 3 /etc/passwd | sort -n | uniq -d If a number, or numbers are returned from the command above, these are UID values which are not unique within the /etc/passwd file. Determine the effected accounts/s: cut -d: -f 1 /etc/passwd | sort -n | uniq -d | while read UID; do cut -f "1 3" -d : /etc/passwd |grep ":${UID}" done Examine the usernames IDs of all configured accounts: cut -d: -f 1 /etc/passwd | sort -n | uniq -d If a username, or usernames are returned from the command above, these are username values which are not unique within the /etc/passwd file. Determine the effected accounts/s: cut -d: -f 1 /etc/passwd | sort -n | uniq -d | while read username; do cut -f "1 3" -d : /etc/passwd |grep "${username}:" done NOTE: Any account names returned should either be deleted or have the UID changed To remove: rmuser <username> To change the UID: chuser id=<id> <username>

속성

운영 체제: 모두
태그: aixaccounts
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 5.1.2 Ensure usernames and UIDs are unique

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix