Ensure local interactive user home directories are configured

СредњаНиво 1Аутоматскаlinux

Опис

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask )) )"
   while IFS=" " read -r l_user l_home; do
      if [ ! -d "$l_home" ]; then
         printf '"'"'%s\n'"'"' " - User: \"$l_user\" home directory \"$l_home\" does not exist"
      else
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is owned by \"$l_own\" (should be owned by \"$l_user\")"
            [ $(( $l_mode & $l_mask )) -gt 0 ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is mode \"$l_mode\" (should be \"$l_max\" or more restrictive)"
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

1. If a local interactive user's home directory is undefined and/or does not exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If the home directory is undefined, set it to the absolute path of that directory: # usermod --home <directory> <username> 2. For each existing home directory reported by the Audit Procedure, make changes in accordance with local site policy and apply the corresponding action: • The directory is not owned by its user - set the owner: # chown <user> <home_directory> • The directory is more permissive than mode 0750 - remove the excess permissions: # chmod g-w,o…

Својства

Оперативни системи: rocky-9
Ознаке: cis-convertedlinux
Референца: CIS Rocky Linux 9 Benchmark v3.0.0 - 7.2.8

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target linux