Ensure usernames and UIDs are unique

中级别 1自动化aix

说明

All users should have a unique UID. In particular the only user on the system to have a UID of 0 should be the root user. Likewise, usernames need to be verified as unique. The only user with a UID of 0 on the system must be the root account. Any account (username) with a UID of 0 has super user privileges on the system and becomes root at login. Access to the root account should be via su, sudo or PKI fingerprint. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

检查方式

审计方法: Shell 命令

shell

command -v cut >/dev/null 2>&1 || exit 1; out=$( { cut -d: -f3 /etc/passwd | sort -n | uniq -d; cut -d: -f1 /etc/passwd | sort | uniq -d ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Examine the user IDs of all configured accounts: cut -d: -f 3 /etc/passwd | sort -n | uniq -d If a number, or numbers are returned from the command above, these are UID values which are not unique within the /etc/passwd file. Determine the effected accounts/s: cut -d: -f 1 /etc/passwd | sort -n | uniq -d | while read UID; do cut -f "1 3" -d : /etc/passwd |grep ":${UID}" done Examine the usernames IDs of all configured accounts: cut -d: -f 1 /etc/passwd | sort -n | uniq -d If a username, or usernames are returned from the command above, these are username values which are not unique within the /etc/passwd file. Determine the effected accounts/s: cut -d: -f 1 /etc/passwd | sort -n | uniq -d | while read username; do cut -f "1 3" -d : /etc/passwd |grep "${username}:" done NOTE: Any account names returned should either be deleted or have the UID changed To remove: rmuser <username> To change the UID: chuser id=<id> <username>

属性

操作系统: 任意
标签: aixaccounts
参考: CIS IBM AIX 7 Benchmark v1.2.0 - 5.1.2 Ensure usernames and UIDs are unique

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target aix