Ensure all directories in root PATH access are configured

檢查方式

稽核方法: Shell 指令

p=$(su - root -c 'echo $PATH' 2>/dev/null | tail -n 1); [ -n "$p" ] || exit 1; r=compliant; IFS=:; set -- $p; unset IFS; for d in "$@"; do case "$d" in "") r="empty entry (current directory) in PATH";; /*) if [ -d "$d" ]; then s=$(ls -ld "$d/" | awk 'substr($1,6,1)=="w" || substr($1,9,1)=="w" || ($3!="root" && $3!="bin") {print $1, $3}'); [ -z "$s" ] || r="$d: $s"; else r="non-existent directory $d in PATH"; fi;; *) r="relative directory $d in PATH";; esac; done; echo "$r"

預期輸出

compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Search and report on group or world writable directories in root's PATH. The command must be run as the root user. The script below traverses up each individual directory PATH, ensuring that all directories are not group/world writable and that they are owned by root or the bin user: echo "/:${PATH}" | tr ':' '\n' | grep "^/" | sort -u | while read DIR do DIR=${DIR:-$(pwd)} print "Checking ${DIR}" while [[ -d ${DIR} ]] do [[ "$(ls -ld ${DIR})" = @(d???????w? *) ]] && print " WARNING ${DIR} is world writable" || print " ${DIR} is not world writable" [[ "$(ls -ld ${DIR})" = @(d????w???? *) ]] && print " WARNING ${DIR} is group writable" || print " ${DIR} is not group writable" [[ "$(ls -ld ${DIR} |awk '{print $3}')" != @(root|bin) ]] && print " WARNING ${DIR} is not owned by root or bin" DIR=${DIR%/*} done done NOTE: Review the output and manually change the directories, if possible. Directories which are group and/or world writable are marked with "WARNING" To manually change permissions on the directories: To remove group writable access: chmod g-w <dir name> To remove world writable access: chmod o-w <dir name> To remove both group and world ... (see CIS section 4.1.2.10)

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

tmaegis scan --target aix