Ensure local interactive user home directories are configured

СреднийУровень 1Автоматическаяlinux

Описание

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

Как проверяется

Метод проверки: Команда оболочки

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask )) )"
   while IFS=" " read -r l_user l_home; do
      if [ ! -d "$l_home" ]; then
         printf '"'"'%s\n'"'"' " - User: \"$l_user\" home directory \"$l_home\" does not exist"
      else
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is owned by \"$l_own\" (should be owned by \"$l_user\")"
            [ $(( $l_mode & $l_mask )) -gt 0 ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is mode \"$l_mode\" (should be \"$l_max\" or more restrictive)"
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

1. If a local interactive user's home directory is undefined and/or does not exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If the home directory is undefined, set it to the absolute path of that directory: # usermod --home <directory> <username> 2. For each existing home directory reported by the Audit Procedure, make changes in accordance with local site policy and apply the corresponding action: • The directory is not owned by its user - set the owner: # chown <user> <home_directory> • The directory is more permissive than mode 0750 - remove the excess permissions: # chmod g-w,o…

Свойства

Операционные системы: almalinux-9
Теги: cis-convertedlinux
Источник: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 7.2.8

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target linux