Ensure world writable files and directories are secured

점검 방법

감사 방식: 셸 명령

command -v find >/dev/null 2>&1 || exit 1; out=$( { find / \( -path /tmp -o -path /proc \) -prune -o -type f -perm -o=w -print; find / \( -path /tmp -o -path /proc \) -prune -o -type d -perm -o=w ! -perm -1000 -print ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

World Writable Files: o It is recommended that write access is removed from other with the command ( chmod o-w <filename> ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file. World Writable Directories: o Set the sticky bit on all world writable directories with the command ( chmod a+t <directory_name> ) Run the following script to: Remove other write permission from any world writable files Add the sticky bit to all world writable directories #!/bin/sh # Define paths to exclude (space-separated) a_path_exclusions="! -path '/tmp/*' ! -path '/proc/*'" # Fix world-writable files by removing the write permission for "others" find / \( $a_path_exclusions \) -type f -perm -o=w -print -exec chmod o-w {} \; # Fix world-writable directories without the sticky bit find / \( $a_path_exclusions \) -type d -perm -o=w ! -perm -1000 -print -exec chmod +t,o-w {} \;

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target freebsd