5.4.4 Ensure default user umask is 027 or more restrictive - /etc/bashrc

Information

Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. A default umask setting of 077 causes files and directories created by users to not be readable by any other user on the system. A umask of 027 would make files and directories readable by users in the same Unix group, while a umask of 022 would make files readable by every user on the system.

Solution

Edit the `/etc/bashrc`, `/etc/profile` and `/etc/profile.d/*.sh` files (and the appropriate files for any other shell supported on your system) and add or edit any umask parameters as follows:
```
umask 027
```

See Also

https://workbench.cisecurity.org/files/1863

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3(4)(d), CSCv6|13

Plugin: Unix

Control ID: 3da1deb997e7439952411dc35d2c942e90104a9b3752c7cb97901f260c4920bd