RHEL 9 must set the umask value to 077 for all local interactive user accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258044	RHEL-09-411025	SV-258044r991589_rule		Medium

Description
The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.

Description

The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 600 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.

STIG	Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide	2024-06-04

Details

Check Text ( C-61785r926117_chk )
Verify that the default umask for all local interactive users is "077". Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file. Check all local interactive user initialization files for interactive users with the following command: Note: The example is for a system that is configured to create users home directories in the "/home" directory. # grep -ri umask /home/ /home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile /home/wadea/.bash_history:grep -i umask /etc/login.defs If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Check Text ( C-61785r926117_chk )

Verify that the default umask for all local interactive users is "077".

Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.

Check all local interactive user initialization files for interactive users with the following command:

Note: The example is for a system that is configured to create users home directories in the "/home" directory.

# grep -ri umask /home/

/home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile
/home/wadea/.bash_history:grep -i umask /etc/login.defs

If any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077", this is a finding.

Fix Text (F-61709r926118_fix)
Remove the umask statement from all local interactive user's initialization files. If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.

Fix Text (F-61709r926118_fix)

Remove the umask statement from all local interactive user's initialization files.

If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the information system security officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.