メニュー
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-6-2-9コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 職業分類に基づく
SKILL.md を表示中
| name | cis-ubuntu1804-v220-6-2-9 |
| description | Ensure local interactive user home directories are configured |
| category | cis-iam |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","users"] |
| cis_id | 6.2.9 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in /etc/passwd without a home directory or with a home directory that does not actually exist.
Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory. Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges. If the user's home directory does not exist or is unassigned, the user will be placed in "/" and will not be able to write any files or have local environment variables set.
Run the following script to Ensure:
#!/usr/bin/env bash
{
l_output="" l_output2="" i_heout2="" l_hoout2="" l_haout2=""
l_valid_shells="^$($ awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\/,g;p}' | paste -s -d '|' - ))$"
unset a_uarr && a_uarr=() # Clear and initialize array
while read -r l_epu l_eph; do # Populate array with users and user home location
a_uarr+=("$l_epu $l_eph")
done <<< "$(awk -v pat="$l_valid_shells" -F: '$(NF) ~ pat { print $1 "
l_asize=
[ -gt ] && -e
-r l_user l_home;
[ -d ];
l_mask=
l_max=
-r l_own l_mode;
[ != ] && l_hoout2=
[ $(( & )) -gt 0 ];
l_haout2=
<<<
l_heout2=
<<<
[ -z ] && l_output= || l_output2=
[ -z ] && l_output= || l_output2=
[ -z ] && l_output=
|| l_output2=
[ -n ] && l_output=
[ -z ];
-e
-e
[ -n ] && -e
}
- Audit Result:
** PASS **
- * Correctly configured *
If a local interactive users' home directory is undefined and/or doesn't exist, follow local site policy and perform one of the following:
/etc/passwd and add the absolute path to the directory to the last field of the user.Run the following script to:
#!/usr/bin/env bash
{
l_output2=""
l_valid_shells="^$($ awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\/,g;p}' | paste -s -d '|' - ))$"
unset a_uarr && a_uarr=() # Clear and initialize array
while read -r l_epu l_eph; do # Populate array with users and user home location
a_uarr+=("$l_epu $l_eph")
done <<< "$(awk -v pat="$l_valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd)"
l_asize="${#a_uarr[@]}" # Here if we want to look at number of users before proceeding
[ "$l_asize " -gt "10000" ] && echo -e "\n ** INFO **\n - \"$l_asize\" Local interactive users found on the system\n - This may be a long running process\n"
while read -r l_user l_home; do
if [ -d "$l_home" ]; then
l_mask='0027'
l_max="$(printf '%o' $(( 0777 & ~$l_mask)) )"
while read -r l_own l_mode; do
if [ "$l_user" != "$l_own" ]; then
l_output2="$l_output2\n - User: \"$l_user\" Home \"$l_home\" is owned by: \"$l_own\"\n - changing ownership to: \"$l_user\"\n"
chown "$l_user" "$l_home"
fi
if [ $(( $l_mode & $l_mask )) -gt 0 ]; then
l_output2="$l_output2\n - User: \"$l_user\" Home \"$l_home\" is mode: \"$l_mode\" should be mode: \"$l_max\" or more restrictive\n - removing excess permissions\n"
chmod g-w,o-rwx "$l_home"
fi
done <<< "$(stat -Lc '%U %#a' "$l_home")"
else
l_output2="$l_output2\n - User: \"$l_user\" Home \"$l_home\" Doesn't exist\n - Please create a home in accordance with local site policy"
fi
done <<< "$(printf '%s\n' "${a_uarr[@]}")"
if [ -z "$l_output2" ]; then # If l_output2 is empty, we pass
echo -e " - No modification needed to local interactive users home directories"
else
echo -e "\n$l_output2"
fi
}