Ensure there are no system 'default group' writable files (objects)

Kako se proverava

Metod provere: Komanda ljuske

command -v lsgroup >/dev/null 2>&1 || exit 1; out=$( { for grp in $(lsgroup -a admin ALL | awk '$2=="admin=true"{print $1}'); do find / \( -fstype jfs -o -fstype jfs2 \) ! -type d -perm -g+w -group "$grp" -print; done ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Review the currently mounted local filesystems using the following to find all world writable files on local JFS/JFS2 filesystems only: Note: the list generated by the command below is for all groups, not just the default system groups. the command without the argument -ls will create a list than can be fed to /usr/bin/xargs to blindly remove the group write permissions. find -L / \( -fstype jfs -o -fstype jfs2 \) -type f -perm -g+w -ls Remedy any files in the list, e.g., chmod g-w {filename} Document any files, and motivate why they are group writeable, and also add documentation re: when/why this exception ceases.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target aix --level 2