Detections
Analytics

6.2.21 Ensure local interactive user is a member of the group owner.

Information

The operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.

Rationale:

If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.

Solution

Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command:
Note: The example will be for the user smithj, who has a home directory of /home/smithj and is a member of the users group.

# chgrp users /home/smithj/<file>

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, CSCv6|3.1, CSCv7|14.6, Rule-ID|SV-204472r603261_rule, STIG-ID|RHEL-07-020670

Plugin: Unix

Control ID: a73b905c1e1b8a4eb6b5a315dc0462fc90b5bf94fa276e70b40cc6e5c7fe6f39