Ensure access is configured for commands referenced by crontab entries

SrednjaNivo 1Ručni pregledaix

Opis

This script checks the permissions of all the root crontab entries, to ensure that they are owned and writable by the root user only. All root crontab entries must be owned and writable by the root user only. If a script had group or world writable access, it could be replaced or edited with malicious content, which would then subsequently run on the system with root authority.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

From the command prompt, execute the following script: crontab -l |egrep -v '^#' |awk '{print $6}' |grep "^/" |sort -u | while read CMD do # first examine the complete command, and later parse the command for it's directory components. CMD=${CMD:-$(pwd)} while [[ -a ${CMD} ]] do [[ "$(ls -ld ${CMD})" = @([-d]???????w? *) ]] && print " WARNING ${CMD} is world writable" [[ "$(ls -ld ${CMD})" = @([-d]????w???? *) ]] && print " WARNING ${CMD} is group writable" [[ "$(ls -ld ${CMD} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${CMD} is not owned ... (full steps: CIS section 4.1.1.17)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Ensure that all root crontab entries are owned and writable by root only. The script below traverses up each individual directory path, ensuring that all directories are not group/world writable and that they are owned by the root or bin user: crontab -l |egrep -v '^#' |awk '{print $6}' |grep "^/" |sort -u | while read CMD do CMD=${CMD:-$(pwd)} while [[ -a ${CMD} ]] do [[ "$(ls -ld ${CMD})" = @([-d]???????w? *) ]] && print " WARNING ${CMD} is world writable" [[ "$(ls -ld ${CMD})" = @([-d]????w???? *) ]] && print " WARNING ${CMD} is group writable" [[ "$(ls -ld ${CMD} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${CMD} is not owned by root or bin" CMD=${CMD%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable or not owned by root are marked with "WARNING" To manually change permissions on the files or directories: To remove group writable access: chmod g-w <name> To remove world writable access: chmod o-w <name> To remove both group and world writable access: chmod go-w <name> To change the owner of a file or directory: chown <new user> <name>

Svojstva

Operativni sistemi: Bilo koji
Oznake: aixpermissions
Referenca: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.1.17 Ensure access is configured for commands referenced by crontab entries