TMA-FREEBSD-6.2.9

Ensure root is the only UID 0 account

嚴重等級 1自動化freebsd

說明

Any account with UID 0 has superuser privileges on the system. This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism, as noted in Item 4.3.7 Ensure access to the su command is restricted. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

檢查方式

稽核方法: Shell 指令

shell

command -v awk >/dev/null 2>&1 || exit 1; out=$( { awk -F: '($3 == 0 && $1 != "root") { print $1 }' /etc/passwd ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Remove any users other than root with UID 0 or assign them a new UID if appropriate.

屬性

作業系統: 不限
標籤: freebsdaccounts
參考資料: CIS FreeBSD 14 Benchmark v1.0.1 - 6.2.9 Ensure root is the only UID 0 account

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target freebsd