Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-221736 | OL07-00-020700 | SV-221736r917848_rule | Medium |
Description |
---|
Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon. |
STIG | Date |
---|---|
Oracle Linux 7 Security Technical Implementation Guide | 2023-06-02 |
Check Text ( C-36279r917846_chk ) |
---|
Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID). Check the home directory assignment for all nonprivileged users on the system with the following command: Note: The example will be for the smithj user, who has a home directory of "/home/smithj" and a primary group of "users". # awk -F: '($4>=1000)&&($7 !~ /nologin/){print $1, $4, $6}' /etc/passwd smithj 1000 /home/smithj # grep 1000 /etc/group users:x:1000:smithj,jonesj,jacksons Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. Check the group owner of all local interactive users' initialization files with the following command: # ls -al /home/smithj/.[^.]* | more -rw-------. 1 smithj users 2984 Apr 27 19:02 .bash_history -rw-r--r--. 1 smithj users 18 Aug 21 2019 .bash_logout -rw-r--r--. 1 smithj users 193 Aug 21 2019 .bash_profile If all local interactive users' initialization files are not group-owned by that user's primary GID, this is a finding. |
Fix Text (F-36243r917847_fix) |
---|
Change the group owner of a local interactive user's files to the group found in "/etc/passwd" for the user. To change the group owner of a local interactive user's home directory, use the following command: Note: The example will be for the user smithj, who has a home directory of "/home/smithj" and has a primary group of users. # chgrp users /home/smithj/.[^.]* |