Title

Local initialization files must be group-owned by the users primary group or root. (Cat II impact)

Discussion

Local initialization files are used to configure the user's shell environment upon login. Malicious modification of these files could compromise accounts upon logon.

Check Content

Check user home directories for local initialization files group-owned by a group other than the user's primary group or root. Procedure: # ls –a /<users home directory> | grep “^\.” | awk '{if ((!($1=="."))&&(!($1==".."))) print}' | xargs ls –ld If any file is not group-owned by root or the user's primary GID, this is a finding.

Fix Text

Change the group-owner of the local initialization file to the user's primary group, or root. # chgrp <user's primary GID> <user's local initialization file> Procedure: for PWLINE in $(cut -d: -f4,6 /etc/passwd); do HOMEDIR=${PWLINE##*:}; GROUP=${PWLINE%%:*}; FILES=$(find ${HOMEDIR} ! -fstype nfs -type f -name '\.*'); for INIFILE in ${FILES}; do GID=$(stat -c %g ${INIFILE}); test "$GROUP" = "${GID}" || chgrp ${GROUP} ${INIFILE}; done; done

Additional Identifiers

Rule ID: SV-45153r1_rule

Vulnerability ID: V-22361

Group Title: GEN001870

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.