backup /etc/passwd- file should be mode 0600
Bug #1923262 reported by
pkaeding
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
shadow (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
CIS hardening benchmarks (6.1.6) suggest that the /etc/passwd- file should be mode 0600 (or more restrictive).
However, this file is 0644 after it is created when the /etc/passwd file is modified. (Ie, a hardening script that creates a hardened system for initial use could change this mode, but it will go out of compliance the next time a backup file is made.)
Changed in shadow (Ubuntu): | |
status: | Incomplete → Confirmed |
To post a comment you must log in.
Hello, this sounds like surprising advice to me -- afterall the /etc/passwd file is 644. I don't know what would be the point of hiding this 'backup' file. Does the benchmark give a rationale for this?
Thanks