TMA-AIX-4.1.2.10
Ensure all directories in root PATH access are configured
Mô tả
To secure the root users executable PATH, all directories must not be group and world writable. There should not be group or world writable directories in the root user's executable path. This may allow an attacker to gain super user access by forcing an administrator operating as root to execute a Trojan horse program. Audit: every directory in root's login PATH must be absolute, exist, be owned by root or bin and not be group/world writable.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; IFS=:; set -- $p; unset IFS; for d in "$@"; do case "$d" in "") r="empty entry (current directory) in PATH";; /*) if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || ($3!="root" && $3!="bin") {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; else r="non-existent directory $d in PATH"; fi;; *) r="relative directory $d in PATH";; esac; done; echo "$r"- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Search and report on group or world writable directories in root's PATH. The command must be run as the root user. The script below traverses up each individual directory PATH, ensuring that all directories are not group/world writable and that they are owned by root or the bin user: echo "/:${PATH}" | tr ':' '\n' | grep "^/" | sort -u | while read DIR do DIR=${DIR:-$(pwd)} print "Checking ${DIR}" while [[ -d ${DIR} ]] do [[ "$(ls -ld ${DIR})" = @(d???????w? *) ]] && print " WARNING ${DIR} is world writable" || print " ${DIR} is not world writable" [[ "$(ls -ld ${DIR})" = @(d????w???? *) ]] && print " WARNING ${DIR} is group writable" || print " ${DIR} is not group writable" [[ "$(ls -ld ${DIR} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${DIR} is not owned by root or bin" DIR=${DIR%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable are marked with "WARNING" To manually change permissions on the directories: To remove group writable access: chmod g-w <dir name> To remove world writable access: chmod o-w <dir name> To remove both group and world ... (see CIS section 4.1.2.10)
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- aixaccounts
- Tham chiếu
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.10 Ensure all directories in root PATH access are configured
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target aix