PT0-001 · Question #169
A penetration tester generates a report for a host-based vulnerability management agent that is running on a production web server to gather a list of running processes. The tester receives the…
The correct answer is B. dbus-daemon. Running dbus-daemon on a production web server violates the principle of minimal installation because it is a desktop inter-process communication service not required for web serving.
Question
A penetration tester generates a report for a host-based vulnerability management agent that is running on a production web server to gather a list of running processes. The tester receives the following information. \ Which of the following processes MOST likely demonstrates a lack of best practices?
Options
- Aapache2
- Bdbus-daemon
- Csystemd
- Durlgrabber-ext
How the community answered
(35 responses)- A3% (1)
- B83% (29)
- C11% (4)
- D3% (1)
Why each option
Running dbus-daemon on a production web server violates the principle of minimal installation because it is a desktop inter-process communication service not required for web serving.
apache2 is the primary web server process and is entirely expected to be running on a production web server.
dbus-daemon is a message bus service designed for desktop environments to facilitate GUI inter-process communication between applications. Its presence on a production web server indicates that unnecessary desktop components are installed, violating the security best practice of minimal footprint and least functionality. This unnecessarily expands the server attack surface beyond what is required to serve web content.
systemd is the standard init and service manager for modern Linux distributions and is a required core operating system component.
urlgrabber-ext is a utility used by package managers such as yum or dnf for downloading packages and may legitimately appear during system maintenance or updates.
Concept tested: Server hardening and minimal process footprint best practices
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-123.pdf
Topics
Community Discussion
No community discussion yet for this question.