Set root Ownership of BIND Configuration Files

Como é verificado

Método de auditoria: Comando shell

BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
out=$(find $BH -type f \! -user root -print 2>/dev/null | { grep -Ev "$RT" || true; }) || exit 1
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out" | head -n 20; echo 'files not owned by root'; }

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Perform the following: ; Capture the output of the previous audit command to a file named nonroot- files.txt and review any files not owned by root to ensure the files are necessary and are not expected run-time files. Delete any unnecessary files, and ensure any run-time files are being created in the appropriate run-time directory. # find $BIND_HOME -type f \! -user root | egrep -v \ \^$DYNDIR\|\^$SLAVEDIR\|\^$DATADIR\|\^$RUNDIR\|\^$LOGDIR\|\^$TMPDIR > \ $TMPDIR/nonroot-files.txt ; The remaining non-run-time files should be changed to be owned by root, with a command like the following: \# cat $TMPDIR/nonroot-files.txt | xargs chown root \# rm $TMPDIR/nonroot-files.txt

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target bind