TMA-KERBEROS-MAX-LIFE

Ensure maximum ticket lifetime is 10 hours or less

보통레벨 1자동kerberos

설명

Long ticket lifetimes extend the window in which a stolen ticket can be replayed. The audit parses max_life in every realm of kdc.conf (/etc/krb5kdc/kdc.conf or /var/kerberos/krb5kdc/kdc.conf), accepting seconds, h:m[:s] and NdNhNmNs forms, and requires it to be set and at most 36000 seconds. Per-principal maximums (kadmin modprinc -maxlife) also apply and are not checked here.

점검 방법

감사 방식: 셸 명령

shell

f=/etc/krb5kdc/kdc.conf; [ -f "$f" ] || f=/var/kerberos/krb5kdc/kdc.conf
[ -f "$f" ] || exit 1
awk -v key=max_life -v lim=36000 '
function dur(s,   t, n, c, p, k) {
  gsub(/[ \t]/, "", s)
  if (s ~ /^[0-9]+$/) return s + 0
  if (s ~ /^[0-9]+:[0-9]+(:[0-9]+)?$/) { k = split(s, p, ":"); return p[1]*3600 + p[2]*60 + (k > 2 ? p[3] : 0) }
  t = 0
  while (match(s, /^[0-9]+[dhms]/)) {
    c = substr(s, RLENGTH, 1); n = substr(s, 1, RLENGTH - 1) + 0
    t += n * (c == "d" ? 86400 : (c == "h" ? 3600 : (c == "m" ? 60 : 1)))
    s = substr(s, RLENGTH + 1)
  }
  return (s == "" ? t : -1)
}
$0 ~ "^[ \t]*" key "[ \t]*=" { v = $0; sub(/^[^=]*=/, "", v); d = dur(v); found = 1; if (d < 0 || d > lim) bad = 1 }
END { if (found && !bad) print "compliant" }' "$f"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

In each realm of kdc.conf set max_life = 10h 0m 0s, restart krb5kdc, and lower krbtgt/<REALM> with kadmin: modprinc -maxlife "10 hours" krbtgt/<REALM>.

속성

운영 체제: 모두
태그: kerberoskdctickets
참고 자료: CIS MIT Kerberos / Linux Benchmark guidance - Kerberos ticket lifetime (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target kerberos