Ensure system accounts are secured

Como é verificado

Método de auditoria: Comando shell

min=$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs); min=${min:-1000}; shells=$(awk -F/ '/^\// && $NF != "nologin"' /etc/shells); bad=0; while IFS=: read -r u p uid g c h sh; do for x in root sync shutdown halt; do [ "$u" = "$x" ] && continue 2; done; case $u in +*) continue;; esac; [ "$uid" -lt "$min" ] 2>/dev/null || continue; printf "%s\n" "$shells" | grep -qxF -- "$sh" && bad=1; done < /etc/passwd; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Run the commands appropriate for your distribution: Set the shell for any accounts returned by the audit to nologin: # usermod -s $(which nologin) <user> Lock any non root accounts returned by the audit: # usermod -L <user> The following command will set all system accounts to a non login shell: awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' && $7!="'"$(which nologin)"'" && $7!="/bin/false") {print $1}' /etc/passwd | while read user; do usermod -s $(which nologin) $user; done The following command will automatically lock not root system accounts: awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | awk '($2!="L" && $2!="LK") {print $1}' | while read user; do usermod -L $user; done

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target cos --level 2