TMA-BIND-2.6

Set Group named or root for BIND Directories and Files

OrtaDüzey 1Otomatikbind

Açıklama

All the BIND directories and files should have a group of either named or root. The audit lists files and directories under $BIND_HOME and $RUNDIR whose group is not root or named (bind on Debian) and requires none. $BIND_HOME is taken as the existing ones of /var/named (RHEL, including a chroot), /etc/bind and /var/cache/bind (Debian/Ubuntu) and $RUNDIR as /run/named; the runtime directories (dynamic, slaves, data, run, log, tmp, /var/cache/bind) are excluded where the benchmark excludes them.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
out=$(find $BH $RUN \! \( $G \) -print 2>/dev/null) || exit 1
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out" | head -n 20; echo 'files or directories with a group other than root/named'; }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Run the command below to change all BIND directories and files to the group named. chgrp -R named $BIND_HOME $RUNDIR

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: binddnspermissions
Referans: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 2.6 Set Group named or root for BIND Directories and Files

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target bind