TMA-APACHE-11.1

Ensure SELinux Is Enabled in Enforcing Mode

NiskaNivo 2Automatskaapache

Opis

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides mandatory access control security policies with type enforcement that are checked after the traditional discretionary access controls. It was created by the US National Security Agency and can enforce rules on files and processes in a Linux system, and restrict actions, based on defined policies. sestatus must report both the current mode and the mode from the config file as enforcing. Not applicable without /etc/selinux/config.

Kako se proverava

Metod provere: Komanda ljuske

shell

s=$(sestatus 2>/dev/null) || exit 1; printf '%s\n' "$s" | awk -F: 'tolower($1)~/current mode/{c=$2} tolower($1)~/mode from config file/{f=$2} END{gsub(/[[:space:]]/,"",c); gsub(/[[:space:]]/,"",f); print (c=="enforcing"&&f=="enforcing")?"compliant":"noncompliant"}'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set SELINUX=enforcing in /etc/selinux/config and run setenforce 1 (reboot if SELinux was disabled).

Svojstva

Operativni sistemi: Bilo koji
Oznake: apacheselinux
Referenca: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 11.1 Ensure SELinux Is Enabled in Enforcing Mode

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target apache --level 2