Ensure local interactive user dot files access is configured

MédiaNível 1Automatizadafreebsd

Descrição

While the system administrator can establish secure permissions for users' "dot" files, the users can easily override these. .forward file specifies an email address to forward the user's mail to. .rhost file provides the "remote authentication" database for the rcp, rlogin, and rsh commands and the rcmd() function. Audit: interactive users must have no .forward/.rhosts files, .netrc and history files at 600, other dot files at 644 or stricter, all owned by the user (group ownership is not evaluated).

Como é verificado

Método de auditoria: Comando shell

shell

command -v awk >/dev/null 2>&1 || exit 1; out=$( { awk -F: '$3>=1000 && $1!="nobody" && $7!~/(nologin|false)$/ {print $1, $6}' /etc/passwd | while read u h; do [ -d "$h" ] || continue; for f in "$h"/.[!.]*; do [ -f "$f" ] || continue; b=${f##*/}; m=$(ls -ld "$f" | awk '{print $1, $3}'); case "$b" in .forward|.rhost|.rhosts) echo "$f must not exist";; .netrc) case "$m" in -rw-------*|-r--------*) ;; *) echo "$f: $m";; esac;; .sh_history|.history) case "$m" in -rw-------*|-r--------*|-------*) ;; *) echo "$f: $m";; esac;; *) printf '%s\n' "$m" | awk 'substr($1,4,1)!="-" || substr($1,6,1)!="-" || substr($1,7,1)!="-" || substr($1,9,1)!="-" || substr($1,10,1)!="-" {print "  mode " $1}' | sed "s|^|$f|";; esac; o=${m#* }; [ "$o" = "$u" ] || echo "$f owned by $o"; done; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken following site policy.

Propriedades

Sistemas operacionais: Qualquer
Tags: freebsdaccounts
Referência: CIS FreeBSD 14 Benchmark v1.0.1 - 6.2.11 Ensure local interactive user dot files access is configured

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target freebsd