Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-4-5-2La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | cis-ubuntu1804-v220-4-5-2 |
| description | Ensure system accounts are secured |
| category | cis-iam |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","users","account-security"] |
| cis_id | 4.5.2 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack |
| ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell.
It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the nologin shell. This prevents the account from potentially being used to run any commands.
Run the following script to verify all local system accounts:
#!/usr/bin/env bash
{
l_output="" l_output2=""
l_valid_shells="$($(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\/,g;p}' | paste -s -d '|' - )$"
a_users=(); a_ulock=()
while read -r l_user; do
a_users+=("$l_user")
done < <(awk -v pat="$l_valid_shells" -F: '($1!~/^(root|sync|shutdown|halt)^\+/) && $3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' && $(NF) ~ pat { print $1 }' /etc/passwd)
while read -r l_ulock; do
a_ulock+=("$l_ulock")
done < <(awk -v pat="$l_valid_shells" -F: '($1!~/^(root)^\+/) && $2!~/LK?/ && $3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' && $(NF) ~ pat { print $1 }' /etc/passwd)
if ! (( ${#a_users[@]} > 0 )); then
l_output="$l_output\n - local system accounts login is disabled"
else
l_output2="$l_output2\n - There are \"$(printf '%s' "${#a_users[@]}")\" system accounts with login enabled\n - List of accounts:\n$(printf '%s\n' "${a_users[@]:0:$l_limit}")\n - end of list\n"
fi
if ! (( ${#a_ulock[@]} > 0 )); then
l_output="$l_output\n - local system accounts are locked"
else
l_output2="$l_output2\n - There are \"$(printf '%s' "${#a_ulock[@]}")\" system accounts that are not locked\n - List of accounts:\n$(printf '%s\n' "${a_ulock[@]:0:$l_limit}")\n - end of list\n"
fi
if [ -z "$l_output2" ]; then
echo -e "\n- Audit Result:\n ** PASS **\n - Correctly configured * :$l_output\n"
else
echo -e "\n- Audit Result:\n ** FAIL **\n - Reasons for audit failure * :$l_output2"
[ -n "$l_output" ] && echo -e "- * Correctly configured * :$l_output\n"
fi
}
Note: The root, sync, shutdown, and halt users are exempted from requiring a non-login shell. root is exempt from being locked.
** PASS ** - Correctly configured
Set the shell for any accounts returned by the audit to nologin:
usermod -s $(which nologin) <user>
Lock any non root accounts returned by the audit:
usermod -L <user>
v8 - 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know.
v7 - 14.6 Protect Information through Access Control Lists.
Automated