diff --git a/benchmarks/access-and-control/1.54-lock-the-bin-and-adm-users.md b/benchmarks/access-and-control/1.54-lock-the-bin-and-adm-users.md new file mode 100644 index 0000000000000000000000000000000000000000..2ad9d95a75c6b78a235bf6c90034fd9409ef276a --- /dev/null +++ b/benchmarks/access-and-control/1.54-lock-the-bin-and-adm-users.md @@ -0,0 +1,36 @@ +# 1.54 锁定或删除bin、adm用户 + +## 安全等级 + +- Level 1 + +## 描述 + +锁定bin、adm用户,避免特定的权限和任务被强制关闭。 + +## 修复建议 + +锁定或删除bin、adm用户。 + +执行以下命令,锁定bin、adm用户 + +```bash +usermod -L bin +usermod -L adm +``` + +## 扫描检测 + +执行以下命令,验证bin、adm用户是否被锁定: + +```bash +# passwd -S bin | grep -E "bin\s+LK" +bin LK 2022-07-12 0 99999 7 -1 (Alternate authentication scheme in use.) + +# passwd -S adm | grep -E "adm\s+LK" +adm LK 2022-02-12 0 99999 7 -1 (Alternate authentication scheme in use.) +``` + +如输出结果符合预期,则视为通过此项检查。 + +## 参考 \ No newline at end of file diff --git a/docs/summary-of-rules.md b/docs/summary-of-rules.md index 27891c324a963b1d71120db5e6930e0f099eb631..1d3bc065fa3f4df343a4417f2cc4bfae46b462e5 100644 --- a/docs/summary-of-rules.md +++ b/docs/summary-of-rules.md @@ -53,6 +53,7 @@ | 1.51 | 1.51-ensure-mounting-of-udf-filesystems-is-disabled.md | 1.51 确保udf文件系统的挂载被禁用 | benchmarks/access-and-control | 1 | | 1.52 | 1.52-ensure-mounting-of-cramfs-filesystems-is-disabled | 1.52 确保cramfs文件系统的挂载被禁用 | benchmarks/access-and-control | 1 | | 1.53 | 1.53-ensure-mounting-of-squashfs-filesystems-is-disabled | 1.53 确保squashfs文件系统的挂载被禁用 | benchmarks/access-and-control | 1 | +| 1.54 | 1.54-lock-the-bin-and-adm-users.md | 1.54 锁定bin、adm用户 | benchmarks/access-and-control | 1 | | 2.1 | 2.1-ensure-audit-log-files-are-not-read-or-write-accessible-by-unauthorized-users.md | 2.1 确保审计日志的文件权限被正确配置 | benchmarks/logging-and-auditing | 1 | | 2.2 | 2.2-ensure-only-authorized-users-own-audit-log-files.md | 2.2 确保审计日志文件的所有者为已授权用户 | benchmarks/logging-and-auditing | 1 | | 2.3 | 2.3-ensure-only-authorized-groups-ownership-of-audit-log-files.md | 2.3 确保审计日志文件的所属组为已授权的用户组 | benchmarks/logging-and-auditing | 1 | diff --git a/remediation-kits/access-and-control/1.54-lock-the-bin-and-adm-users.sh b/remediation-kits/access-and-control/1.54-lock-the-bin-and-adm-users.sh new file mode 100644 index 0000000000000000000000000000000000000000..3ef8c55360805030d522d04db91c1842f8d0a633 --- /dev/null +++ b/remediation-kits/access-and-control/1.54-lock-the-bin-and-adm-users.sh @@ -0,0 +1,2 @@ +usermod -L bin +usermod -L adm \ No newline at end of file diff --git a/scanners/access-and-control/1.54-lock-the-bin-and-adm-users.sh b/scanners/access-and-control/1.54-lock-the-bin-and-adm-users.sh new file mode 100644 index 0000000000000000000000000000000000000000..71fc6e06c60644bcc70628d02fcd78a396a61ea1 --- /dev/null +++ b/scanners/access-and-control/1.54-lock-the-bin-and-adm-users.sh @@ -0,0 +1,9 @@ +result=false + +passwd -S bin | grep -Eq "bin\s+LK" && passwd -S adm | grep -Eq "adm\s+LK" && result=true + +if [ "$result" = true ]; then + echo "pass" +else + echo "fail" +fi \ No newline at end of file