Ensure all groups in /etc/passwd exist in /etc/group

中等級 2自動化cos

說明

Over time, system administration errors and changes can lead to groups being defined in /etc/passwd but not in /etc/group . Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.

檢查方式

稽核方法: Shell 指令

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_passwd_group_gid=("$(awk -F: '"'"'{print $4}'"'"' /etc/passwd | sort -u)")
   a_group_gid=("$(awk -F: '"'"'{print $3}'"'"' /etc/group | sort -u)")
   a_passwd_group_diff=("$(printf '"'"'%s\n'"'"' "${a_group_gid[@]}" "${a_passwd_group_gid[@]}" | sort | uniq -u)")
   while IFS= read -r l_gid; do
      awk -F: '"'"'($4 == '"'"'"$l_gid"'"'"') {print "  - User: \"" $1 "\" has GID: \"" $4 "\" which does not exist in /etc/group" }'"'"' /etc/passwd
   done < <(printf '"'"'%s\n'"'"' "${a_passwd_group_gid[@]}" "${a_passwd_group_diff[@]}" | sort | uniq -D | uniq)
   unset a_passwd_group_gid; unset a_group_gid; unset a_passwd_group_diff
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found.

屬性

作業系統: 不限
標籤: container-optimized-oscos
參考資料: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.15 Ensure all groups in /etc/passwd exist in /etc/group

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cos --level 2