Detections
Analytics

GEN001740 - All global initialization files must be owned by root - '/etc/csh.login'

Information

Global initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon. Failure to give ownership of sensitive files or utilities to root or bin provides the designated owner and unauthorized users with the potential to access sensitive information or change the system configuration which could weaken the system's security posture.

Solution

Change the ownership of global initialization files with incorrect ownership.

Procedure:
# chown root <global initialization files>

or:
# ls etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/csh.logout /etc/environment /etc/ksh.kshrc /etc/profile /etc/suid_profile /etc/profile.d/* 2>null|xargs stat -L -c %U:%n|egrep -v '^root'|cut -d: -f2|xargs chown root
will set the owner of all files not currently owned by root to root.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_5_V2R1_STIG.zip

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT

References: 800-53|AC-6, 800-53|CM-5(6), CAT|II, CCI|CCI-000225, CCI|CCI-001499, Rule-ID|SV-218327r603259_rule, STIG-ID|GEN001740, STIG-Legacy|SV-63869, STIG-Legacy|V-11982, Vuln-ID|V-218327

Plugin: Unix

Control ID: e494ce822a550612993b03e6c8a8c0f6517323aaeb6fd49bc8a5296b30dbb8eb