When setting Azure policy on a Linux VM, Microsoft uses the OMS agent to configure everything, in particular, the omsremediate command. Looking through their GitHub site for the OMS agent for Linux, I found their oms_audit.xml file, which lists audit findings and remediations for various policy items (https://github.com/Microsoft/OMS-Agent-for-Linux/blob/master/source/code/plugins/oms_audits.xml ). Audit finding #28 (fix-home-dir-permissions) states that home directory permissions should be set to 750 or more restrictive. Looking at the remediation for this further down in the file, MS provides this script snippet to fix the problem:
chmod 750 /home/*
if [ -e /var/lib/libuuid ]; then
chmod 750 /var/lib/libuuid
fi
chmod 750 /var/run/dbus
chmod 750 /var/run/dbus
# /var/run/sshd created by service at bootup
if [ -e /etc/init.d/ssh ]; then
sed -i 's/\(chmod\s\+\)[0-7]\{4\}/\10750/g' /etc/init.d/ssh
fi
if [ -e /etc/init.d/sshd ]; then
sed -i 's/\(chmod\s\+\)[0-7]\{4\}/\10750/g' /etc/init.d/sshd
fi
if [ -e /etc/init/ssh.conf ]; then
sed -i 's/\(mkdir\s\+-p\s\+-m\)[0-9]\{4\}/\10750/g' /etc/init/ssh.conf
fi
The first line, I understand. It's setting everything under /home to 750. But what about the next several lines? Is this an error or is there a reason to be changing permissions on /var/lib/libuuid, /var/run/dbus, /etc/init.d/ssh, /etc/init.d/sshd, and /etc/init/ssh.conf? I'm trying to figure out if those lines in the snippet belong under the "fix home dir permissions" section or if they should be somewhere else? I'm trying to translate an existing script that makes extensive use of omsremediate into a script that simply uses native Linux commands, depending on the distro. Anyone have any insight as to why these additional lines would fall under the "fix home dir permissions" section?
Asked by msaacs
(1 rep)
May 14, 2024, 06:05 PM
Last activity: May 15, 2024, 02:10 AM
Last activity: May 15, 2024, 02:10 AM