TMA-FREEBSD-6.2.9
Ensure root is the only UID 0 account
KritikDüzey 1Otomatikfreebsd
Açıklama
Any account with UID 0 has superuser privileges on the system. This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism, as noted in Item 4.3.7 Ensure access to the su command is restricted. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
shell
command -v awk >/dev/null 2>&1 || exit 1; out=$( { awk -F: '($3 == 0 && $1 != "root") { print $1 }' /etc/passwd ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Remove any users other than root with UID 0 or assign them a new UID if appropriate.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- freebsdaccounts
- Referans
- CIS FreeBSD 14 Benchmark v1.0.1 - 6.2.9 Ensure root is the only UID 0 account
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
shell
tmaegis scan --target freebsd