Ensure local interactive user home directories are configured

OrtaDüzey 1Otomatiklinux

Açıklama

The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   l_valid_shells="^($( awk -F\/ '"'"'$NF != "nologin" {print}'"'"' /etc/shells | sed -rn '"'"'/^\//{s,/,\\/,g;p}'"'"' | paste -s -d '"'"'|'"'"' - ))$"
   l_mask='"'"'0027'"'"'; l_max="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_mask )) )"
   while IFS=" " read -r l_user l_home; do
      if [ ! -d "$l_home" ]; then
         printf '"'"'%s\n'"'"' " - User: \"$l_user\" home directory \"$l_home\" does not exist"
      else
         while IFS=: read -r l_own l_mode; do
            [ "$l_user" != "$l_own" ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is owned by \"$l_own\" (should be owned by \"$l_user\")"
            [ $(( $l_mode & $l_mask )) -gt 0 ] && printf '"'"'%s\n'"'"' " - User: \"$l_user\" home \"$l_home\" is mode \"$l_mode\" (should be \"$l_max\" or more restrictive)"
         done <<< "$(stat -Lc '"'"'%U:%#a'"'"' "$l_home")"
      fi
   done <<< "$(awk -v pat="$l_valid_shells" -F: '"'"'$(NF) ~ pat { print $1 " " $(NF-1) }'"'"' /etc/passwd)"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. If a local interactive user's home directory is undefined and/or does not exist, follow local site policy and perform one of the following: • Lock the user account • Remove the user from the system • Create a directory for the user. If the home directory is undefined, set it to the absolute path of that directory: # usermod --home <directory> <username> 2. For each existing home directory reported by the Audit Procedure, make changes in accordance with local site policy and apply the corresponding action: • The directory is not owned by its user - set the owner: # chown <user> <home_directory> • The directory is more permissive than mode 0750 - remove the excess permissions: # chmod g-w,o…

Özellikler

İşletim sistemleri: almalinux-9
Etiketler: cis-convertedlinux
Referans: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 7.2.8

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target linux