Detections
Analytics
GEN001390 - The /etc/passwd file must not have an extended ACL.
Information
File system ACLs can provide access to files beyond what is allowed by the mode numbers of the files. The /etc/passwd file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification.Solution
Remove the extended ACL from the file.# setfacl --remove-all /etc/passwd
See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-6, CAT|II, CCI|CCI-000225, Group-ID|V-22334, Rule-ID|SV-37346r1_rule, STIG-ID|GEN001390, Vuln-ID|V-22334
Plugin: Unix
Control ID: 4b901e06c024dc4b470dde9ef7143fa763fc63a0ff62c3554104d22d8991c50e