Ensure the NGINX service account has an invalid shell

SrednjaNivo 1Automatskanginx

Opis

The NGINX service account must be configured with an invalid login shell to prevent interactive access. Reads the account from the user directive; its login shell must be nologin or false. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; sh=$(getent passwd "$u" | cut -d: -f7) || exit 1; case "$sh" in */nologin|/bin/false|/usr/bin/false) echo compliant;; *) echo noncompliant;; esac

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

usermod -s /sbin/nologin <nginx user> (use /usr/sbin/nologin on Debian/Ubuntu).

Svojstva

Operativni sistemi: Bilo koji
Oznake: nginxaccounts
Referenca: CIS NGINX Benchmark v3.0.0 - 2.2.3 Ensure the NGINX service account has an invalid shell

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target nginx