A security audit reveals that several non-interactive service accounts on Linux production application servers have interactive login shells assigned in `/etc/passwd`. Additionally, auditors found that world-writable temporary storage locations (`/tmp` and `/var/tmp`) are mounted on the main filesystem partition without restrictive execution flags, allowing local users to execute binaries placed in these directories. Which of the following technical mitigation steps provides the most effective hardening baseline to directly address both audit findings?
- Mount temporary partitions using the `noexec` mount option and change non-interactive service account shells to `/sbin/nologin`.Cevap
- BDeploy a perimeter Web Application Firewall (WAF) rule to strip shell characters from incoming HTTP requests directed at service endpoints.
- CConfigure an inline deception honeypot directory within `/tmp` to capture and automatically isolate unauthorized executable files.
- DChange ownership of `/tmp` to the root account while leaving standard read, write, and execute permission bits unchanged.
Cevap
Mount temporary partitions using the `noexec` mount option and change non-interactive service account shells to `/sbin/nologin`.
Mounting temporary partitions with the `noexec` flag disables the kernel execution bit for all files residing in those mount points, neutralising malware staging in shared folders like `/tmp`. Updating service account login shells to `/sbin/nologin` prevents adversaries from spawning interactive command shells if a service account context is compromised.
Adım Adım Çözüm
Anahtar Kavram
Host Hardening Baselines and Attack Surface Reduction