TMA-KERBEROS-KDC-DB-PERMS

Ensure the KDC database and master key stash are accessible only by root

심각레벨 1자동kerberos

설명

The principal database and the stash file (.k5.<REALM>) together expose every long-term key in the realm. The audit inspects the KDC state directory (/var/lib/krb5kdc on Debian/Ubuntu, /var/kerberos/krb5kdc on RHEL) and fails if any principal* or .k5.* file has group or other permissions or is not owned by root.

점검 방법

감사 방식: 셸 명령

shell

n=0
for d in /var/lib/krb5kdc /var/kerberos/krb5kdc; do
  [ -d "$d" ] || continue
  n=$((n+1))
  bad=$(find "$d" -maxdepth 1 -type f \( -name 'principal*' -o -name '.k5.*' \) \( -perm /077 -o ! -user root \) 2>/dev/null) || exit 1
  [ -z "$bad" ] || { printf '%s\n' "$bad"; exit 1; }
done
[ "$n" -gt 0 ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 셸 명령

shell

for d in /var/lib/krb5kdc /var/kerberos/krb5kdc; do if [ -d "$d" ]; then find "$d" -maxdepth 1 -type f \( -name 'principal*' -o -name '.k5.*' \) -exec chown root:root {} + -exec chmod 600 {} + || exit 1; fi; done

속성

운영 체제: 모두
태그: kerberoskdcpermissionskeys
참고 자료: CIS MIT Kerberos / Linux Benchmark guidance - KDC database and stash file protection (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target kerberos