STIGQter: STIG Summary: Red Hat Enterprise Linux 7 Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 23 Apr 2021:

The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.

DISA Rule

SV-204392r646841_rule

Vulnerability Number

V-204392

Group Title

SRG-OS-000257-GPOS-00098

Rule Version

RHEL-07-010010

Severity

CAT I

CCI(s)

• CCI-001494 - The information system protects audit tools from unauthorized modification.
• CCI-001496 - The information system implements cryptographic mechanisms to protect the integrity of audit tools.
• CCI-002165 - The information system enforces organization-defined discretionary access control policies over defined subjects and objects.
• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Run the following command to determine which package owns the file:

# rpm -qf <filename>

Reset the user and group ownership of files within a package with the following command:

# rpm --setugids <packagename>


Reset the permissions of files within a package with the following command:

# rpm --setperms <packagename>

Check Contents

Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.

Check the default file permissions, ownership, and group membership of system files and commands with the following command:

# for i in `rpm -Va | egrep '^.{1}M|^.{5}U|^.{6}G' | cut -d " " -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f 1,5,6,7 | grep $i;done;done

/var/log/gdm 040755 root root
/etc/audisp/audisp-remote.conf 0100640 root root
/usr/bin/passwd 0104755 root root

For each file returned, verify the current permissions, ownership, and group membership:
# ls -la <filename>

-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf

If the file is more permissive than the default permissions, this is a finding.

If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.

If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.

Vulnerability Number

V-204392

Documentable

False

Rule Version

RHEL-07-010010

Severity Override Guidance

Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.

Check the default file permissions, ownership, and group membership of system files and commands with the following command:

# for i in `rpm -Va | egrep '^.{1}M|^.{5}U|^.{6}G' | cut -d " " -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f 1,5,6,7 | grep $i;done;done

/var/log/gdm 040755 root root
/etc/audisp/audisp-remote.conf 0100640 root root
/usr/bin/passwd 0104755 root root

For each file returned, verify the current permissions, ownership, and group membership:
# ls -la <filename>

-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf

If the file is more permissive than the default permissions, this is a finding.

If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.

If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.

Check Content Reference

M

Target Key

2899

Comments