TMA-BIND-2.1
Run BIND as a non-root User
Descrição
To start BIND you must execute it as the root user. After the initial startup, BIND has the ability to change to a non-root user, allowing it to drop the root privileges. The audit requires a running named process started with -u named (or -u bind on Debian), not owned by root, whose account UID is between 1 and UID_MIN-1.
Como é verificado
Método de auditoria: Comando shell
out=$(ps -eo user=,args= 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | awk '$2 ~ /(^|\/)named$/')
[ -n "$p" ] || { echo 'named is not running'; exit 1; }
printf '%s\n' "$p" | awk '$1 == "root"' | grep -q . && { echo 'named runs as root'; exit 1; }
printf '%s\n' "$p" | grep -Eq ' -u (named|bind)( |$)' || { echo 'named started without -u named/bind'; exit 1; }
u=$(printf '%s\n' "$p" | awk '{print $1; exit}'); uid=$(id -u "$u" 2>/dev/null) || exit 1
min=$(awk '$1=="UID_MIN"{print $2}' /etc/login.defs 2>/dev/null); min=${min:-1000}
[ "$uid" -gt 0 ] && [ "$uid" -lt "$min" ] && echo compliant || echo "named account uid $uid (UID_MIN $min)"- Saída esperada
compliant
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Create the named user and group if it does not already exist. Using a shell of /dev/null is best practice. if ! id named; then groupadd -g 53 named useradd -m -u 53 -g 53 -c "BIND named" -d /var/named -s /dev/null named fi 2>/dev/null Add the -u named to the OPTIONS parameters in the /etc/sysconfig/named if not already present.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- binddnspermissions
- Referência
- CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 2.1 Run BIND as a non-root User
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target bind