Navigate

Check: GEN002300

VMware ESX 3 Server: GEN002300 (in version v1 r2)

Title

Device files used for backup must only be readable and/or writable by root or the backup user. (Cat II impact)

Discussion

System backups could be accidentally or maliciously overwritten and destroy the ability to recover the system if a compromise should occur. Unauthorized users could also copy system files.

Check Content

Check the system for world-writable device files. Procedure: # find / -perm -2 -a \( -type b -o -type c \) -exec ls -ld {} \; If any device file(s) used for backup are writable by users other than root, this is a finding.

Fix Text

Use the chmod command to remove the world-writable bit from the backup device files. Procedure: # chmod o-w backdevicefilename Document all changes.

Additional Identifiers

Rule ID: SV-925r2_rule

Vulnerability ID: V-925

Group Title: GEN002300

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000225	Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-6	Least Privilege