Detections
Analytics

5.5.9 Ensure local interactive user accounts umask is 077

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The operating system must set the umask value to 077 for all local interactive user accounts.

The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.

Solution

Remove the umask statement from all local interactive user's initialization files.

Using the list collected in the audit run the following command on all the files located with a less restrictive umask:

user@server# ~]$ echo 'umask 077' [] /home/user/path_to_file

If the account is for an application, the requirement for a umask less restrictive than 077 can be documented, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-3e., 800-53|CM-3f., 800-53|CM-5(1), 800-53|CM-6c., 800-53|CM-11(2), CAT|II, CCI|CCI-000318, CCI|CCI-000368, CCI|CCI-001812, CCI|CCI-001813, CCI|CCI-001814, CSCv7|14.6, Rule-ID|SV-204488r603261_rule, STIG-ID|RHEL-07-021040, Vuln-ID|V-204488

Plugin: Unix

Control ID: adb6b3307b0c850a123d4e284b02fcecbdb88e1eccb8713a59df729a49c6dfd6