Detections
Analytics

5.4.3.3 Ensure default user umask is configured in /etc/login.defs

Information

/etc/login.defs sets system-wide account defaults. Its UMASK value is the umask baseline that pam_umask applies to a login session before any shell-initialization file runs, and that useradd uses when creating a home directory. It governs the umask for sessions that do not source the interactive shell-initialization files.

If the /etc/login.defs UMASK is missing or less restrictive than 0027, sessions that never run the shell-initialization files -- and files created during account setup -- receive permissions readable or writable by other users. A restrictive baseline here ensures a safe default even where shell-level umask settings do not apply.

Solution

Edit /etc/login.defs and set the UMASK line to 0027 or more restrictive:

UMASK 027

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6b., 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: e683c2ba0a71e662f45ccf999f9cfb81895554add0ed24f70c204f663991feda