Ensure XDMCP is not enabled

检查方式

审计方法: Shell 命令

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   while IFS= read -r l_file; do
      awk '"'"'/\[xdmcp\]/{ f = 1;next } /\[/{ f = 0 } f {if (/^\s*Enable\s*=\s*true/) print "The file: \"'"'"'"$l_file"'"'"'\" includes: \"" $0 "\" in the \"[xdmcp]\" block"}'"'"' "$l_file"
   done < <(grep -Psil -- '"'"'^\h*\[xdmcp\]'"'"' /etc/{gdm3,gdm}/{custom,daemon}.conf)
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

预期输出

compliant

修复方式

修复方法: 操作指南或基础设施补丁

Edit all files returned by the audit and remove or comment out the Enable=true line in the [xdmcp] block: Example File: # GDM configuration storage # # See /usr/share/gdm/gdm.schemas for a list of available options. [daemon] # Uncomment the line below to force the login screen to use Xorg #WaylandEnable=false # Enabling automatic login # AutomaticLoginEnable = true # AutomaticLogin = user1 # Enabling timed login # TimedLoginEnable = true # TimedLogin = user1 # TimedLoginDelay = 10 [security] [xdmcp] # Enable=true <- **This line should be removed or commented out** [chooser] [debug] # Uncomment the line below to turn on debugging # More verbose logs # Additionally lets the X server dump core …

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

tmaegis scan --target linux