Ensure authentication required for single user mode

MédiaNível 1Automatizadacos

Descrição

Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader. Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue' || { echo step1: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency' || { echo step2: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.

Propriedades

Sistemas operacionais: Qualquer
Tags: authcontainer-optimized-oscos
Referência: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.3.1 Ensure authentication required for single user mode

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target cos