TMA-ROS1-1.10

Disable rosmaster listening on all interfaces by default

高级别 1自动化ros

说明

rosmaster is the handshaking server responsible for connecting publishers to subscribers and vice-versa. By default it listens on all interfaces on a given machine, including external interfaces. This greatly increases attack surface area, and is only required if one is using distributed computing (where multiple machines are running ROS and need to connect to the same master). The audit requires the ROS master port 11311 to listen only on loopback (ss); when rosmaster is not running it requires every running ROS 1 process to have ROS_HOSTNAME (or ROS_IP) set to localhost. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

检查方式

审计方法: Shell 命令

shell

command -v ss >/dev/null 2>&1 || exit 1
l=$(ss -Hltn 'sport = :11311' 2>/dev/null) || exit 1
if [ -n "$l" ]; then bad=$(printf '%s\n' "$l" | awk '{print $4}' | grep -Ev '^(127\.[0-9.]+|\[::1\]|::1):11311$')
  [ -z "$bad" ] && echo compliant || echo "rosmaster listens on: $(printf '%s ' $bad)"; exit 0; fi
bad=0; for e in /proc/[0-9]*/environ; do env=$( (tr '\0' '\n' < "$e") 2>/dev/null ) || continue
  case "$env" in *ROS_DISTRO=melodic*|*ROS_MASTER_URI=*) ;; *) continue ;; esac
  h=$(printf '%s\n' "$env" | sed -n 's/^ROS_HOSTNAME=//p;s/^ROS_IP=//p' | head -n 1)
  case "$h" in localhost|127.0.0.1|::1) ;; *) echo "pid ${e#/proc/}: ROS_HOSTNAME/ROS_IP=${h:-unset}"; bad=1 ;; esac
done
[ "$bad" -eq 0 ] && echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Ensure the ROS_HOSTNAME environment variable is set to localhost, thereby ensuring rosmaster only listens on loopback and isn't accessible on the network. One can cover most user session services and applications by adding the following line to /etc/environment: ROS_HOSTNAME="localhost" Note that this will not cover systemd system units. If a unit is being created that runs rosmaster (e.g. roscore or roslaunch), make sure this environment variable is set by utilizing Environment=, EnvironmentFile=, or similar.

属性

操作系统: 任意
标签: rosros1melodicsystem
参考: CIS ROS Melodic Benchmark v1.0.0 - 1.10 Disable rosmaster listening on all interfaces by default

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target ros