Ensure local interactive user home directories are configured

보통레벨 1자동linux

설명

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=() a_output2=() a_exists2=() a_mode2=() a_owner2=()
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask)) )"
   l_users="$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd | wc -l)"
   [ "$l_users" -gt 10000 ] && printf '"'"'%s\n'"'"' "" "  ** INFO **" \
   "  $l_users Local interactive users found on the system" "  This may be a long running check" "  **********"
   while IFS=" " read -r l_user l_home; do
      if [ -d "$l_home" ]; then
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && a_owner2+=("  - User: \"$l_user\" Home \"$l_home\" is owned by: \"$l_own\"")
            [ $(( $l_mode & $l_mask )) -gt 0 ] && a_mode2+=("  - User: \"$l_user\" Home \"$l_home\" is mode: \"$l_mode\"" \
            "    should be mode: \"$l_max\" or more restrictive")
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      else
         a_exists2+=("  - User: \"$l_user\" Home Directory: \"$l_home\" Doesn'"'"'t exist")
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
   [ "${#a_exists2[@]}" -gt 0 ] && a_output2+=("${a_exists2[@]}") || \
   a_output+=("  - All interactive users home directories exist")
   [ "${#a_mode2[@]}" -gt 0 ] && a_output2+=("${a_mode2[@]}") || \
   a_output+=("  - All interactive users home directories are mode \"$l_max\" or more restrictive")
   [ "${#a_owner2[@]}" -gt 0 ] && a_output2+=("${a_owner2[@]}") || \
   a_output+=("  - All interactive users own their home directory")
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}"
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" " - Reason(s) for audit failure:" "${a_output2[@]}"
      [ "${#a_output[@]}" -gt 0 ] && printf '"'"'%s\n'"'"' "- Correctly set:" "${a_output[@]}"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

If a local interactive users' home directory is undefined and/or doesn't exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If undefined, edit /etc/passwd and add the absolute path to the directory to the last field of the user. Run the following script to: • Remove excessive permissions from local interactive users home directories • Update the home directory's owner #!/usr/bin/env bash { a_output=() a_output2=() a_exists2=() a_mode2=() a_owner2=() l_valid_shells="^($( awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\\\/,g;p}' | paste -s -d '|' - ))$" l_mask='002…

속성

운영 체제: alinux-3
태그: cis-convertedlinux
참고 자료: CIS Alibaba Cloud Linux 3 Benchmark v2.0.0 - 7.2.8

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux