Ensure accounts without a valid login shell are locked

보통레벨 1자동linux

설명

There are a number of accounts provided with most distributions that are used to manage applications. Additionally, an administrator may add special accounts that are not intended for interactive use.

점검 방법

감사 방식: 셸 명령

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($(awk -F\/ '"'"'($NF != "nologin" && $NF != "false") {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   while IFS= read -r l_user; do
      passwd -S "$l_user" | awk '"'"'$2 !~ /^L/ {print "Account: \"" $1 "\" does not have a valid login shell and is not locked"}'"'"'
   done < <(awk -v pat="$l_valid_shells" -F: '"'"'($1 != "root" && $(NF) !~ pat) {print $1}'"'"' /etc/passwd)
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following command to lock any non-root accounts without a valid login shell returned by the audit: # usermod -L <user> Example script: #!/usr/bin/env bash { l_valid_shells="^($(awk -F\/ '($NF != "nologin" && $NF != "false") {print}' /etc/shells | sed -rn '/^\//{s,/,\\\\/,g;p}' | paste -s -d '|' - ))$" while IFS= read -r l_user; do passwd -S "$l_user" | awk '$2 !~ /^L/ {system ("usermod -L " $1)}' done < <(awk -v pat="$l_valid_shells" -F: '($1 != "root" && $(NF) !~ pat) {print $1}' /etc/passwd) }

속성

운영 체제: almalinux-9
태그: cis-convertedlinux
참고 자료: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.4.2.8

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux