Title

Device files used for backup must only be readable and/or writable by root or the backup user. (Cat II impact)

Discussion

System backups could be accidentally or maliciously overwritten and destroy the ability to recover the system if a compromise should occur. Unauthorized users could also copy system files.

Check Content

Check the system for world-writable device files. Procedure: # find / -perm -2 -a \( -type b -o -type c \) -exec ls -ld {} \; If any device file(s) used for backup are writable by users other than root, this is a finding.

Fix Text

Use the chmod command to remove the world-writable bit from the backup device files. Procedure: # chmod o-w backdevicefilename Document all changes.

Additional Identifiers

Rule ID: SV-227700r603266_rule

Vulnerability ID: V-227700

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.