Detections
Analytics

5.5.8 Ensure Default user umask is 077

Information

The operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.

Solution

Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

Add or edit the line for the UMASK parameter in /etc/login.defs file to 077 :

Example: vim /etc/login.defs

Add, uncomment or update the following line:

UMASK 077

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, CSCv7|14.6, Rule-ID|SV-204457r603261_rule, STIG-ID|RHEL-07-020240, Vuln-ID|V-204457

Plugin: Unix

Control ID: 90db44d440a5814f350cf439bd60fa055d34e2f8146c51b4fe25e1f2b95c733d