TMA-KERBEROS-MAX-RENEWABLE-LIFE

Ensure maximum renewable ticket lifetime is 7 days or less

低等級 1自動化kerberos

說明

Renewable tickets can be refreshed without the password until max_renewable_life expires. The audit parses max_renewable_life in kdc.conf (/etc/krb5kdc/kdc.conf or /var/kerberos/krb5kdc/kdc.conf) and requires it to be set and at most 604800 seconds.

檢查方式

稽核方法: Shell 指令

shell

f=/etc/krb5kdc/kdc.conf; [ -f "$f" ] || f=/var/kerberos/krb5kdc/kdc.conf
[ -f "$f" ] || exit 1
awk -v key=max_renewable_life -v lim=604800 '
function dur(s,   t, n, c, p, k) {
  gsub(/[ \t]/, "", s)
  if (s ~ /^[0-9]+$/) return s + 0
  if (s ~ /^[0-9]+:[0-9]+(:[0-9]+)?$/) { k = split(s, p, ":"); return p[1]*3600 + p[2]*60 + (k > 2 ? p[3] : 0) }
  t = 0
  while (match(s, /^[0-9]+[dhms]/)) {
    c = substr(s, RLENGTH, 1); n = substr(s, 1, RLENGTH - 1) + 0
    t += n * (c == "d" ? 86400 : (c == "h" ? 3600 : (c == "m" ? 60 : 1)))
    s = substr(s, RLENGTH + 1)
  }
  return (s == "" ? t : -1)
}
$0 ~ "^[ \t]*" key "[ \t]*=" { v = $0; sub(/^[^=]*=/, "", v); d = dur(v); found = 1; if (d < 0 || d > lim) bad = 1 }
END { if (found && !bad) print "compliant" }' "$f"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

In each realm of kdc.conf set max_renewable_life = 7d 0h 0m 0s, restart krb5kdc, and apply the same limit to krbtgt/<REALM> with kadmin: modprinc -maxrenewlife "7 days" krbtgt/<REALM>.

屬性

作業系統: 不限
標籤: kerberoskdctickets
參考資料: CIS MIT Kerberos / Linux Benchmark guidance - Kerberos ticket lifetime (verify section number for your release)

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target kerberos