Ensure authentication required for single user mode

СредњаНиво 1Аутоматскаcos

Опис

Single user mode (rescue mode) is used for recovery when the system detects an issue during boot or by manual selection from the bootloader. Requiring authentication in single user mode (rescue mode) prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/rescue.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue' || { echo step1: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; o=$(bash -c 'grep /systemd-sulogin-shell /usr/lib/systemd/system/emergency.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency' || { echo step2: missing 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Rootfs is read-only file system. Therefore, update to an OS image which requires single user mode authentication.

Својства

Оперативни системи: Било који
Ознаке: authcontainer-optimized-oscos
Референца: CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.3.1 Ensure authentication required for single user mode

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target cos