I'm performing a CIS-CAT scan and I'm questioning the results of the scanner being poorly designed. Now I am running on Debian 9 which isn't officially supported by the scanner but I can get it to run and I've implemented 95% of their requirements and can successfully scan using the following command:
sudo ./CIS-CAT.sh -f -D ignore.platform.mismatch=true -D include.csv.remediation=true -csv
/bin has permissions of drwxr-x--x and they want me to remove execute for other, however if I "chmod o-x /bin"
then a regular user cannot execute standard commands like "ls"
Is there a different approach to this?
Same thing with the following:
/dev
/var/cache/man
/run/systemd
/run/dbus
/run/sshd
which have permissions of drwxr-xr-x. CIS-CAT wants me to remove other read and execute but it's permissions get reset on reboot.
Here's the scan results:
File: /usr/sbin
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /bin
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /dev
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /usr/games
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /var/cache/man
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /var/spool/lpd
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /var/mail
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /var/spool/news
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /var/spool/uucp
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /bin
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /var/www
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /var/backups
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /var/list
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /run/ircd
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /var/lib/gnats
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /nonexistent
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /run/systemd
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /run/systemd/netif
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /run/systemd/resolve
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /run/systemd
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /nonexistent
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /var/spool/exim4
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /run/dbus
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /run/sshd
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false true
the file's Other Execute to be set to false true
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /home/UserName
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false
File: /nonexistent
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /home/ntp
CIS-CAT expected any number of matching file items to be collected, and found 0 items.
File: /home/esets
CIS-CAT Expected... CIS-CAT Collected...
the file's Other Read to be set to false false
the file's Other Execute to be set to false false
the file's Other Write to be set to false false
the file's Group Write to be set to false false