V-285668

Discussion

Default file and directory permissions determine which users are authorized to access newly created system resources. If default permissions are overly permissive, unauthorized users may gain access to sensitive information or modify resources without authorization. Configuring a restrictive default UMASK ensures newly created files and directories are accessible only to the creating user unless additional permissions are explicitly granted. This helps enforce the principle of least privilege and prevents inadvertent disclosure of information to unauthorized users. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000074-GPOS-00042, SRG-OS-000075-GPOS-00043, SRG-OS-000076-GPOS-00044, SRG-OS-000480-GPOS-00226

Check Content

Verify Harvester Government enforces restrictive default permissions for newly created files and directories.

1. Access a Harvester node using a privileged account and verify the login configuration file exists:

ls -l /etc/login.defs

If /etc/login.defs does not exist, this is a finding.

2. Verify the default UMASK setting:

grep -E "^UMASK" /etc/login.defs

3. Verify the output returns:

UMASK 077

If the UMASK parameter is missing, commented out, or configured with a value other than 077, this is a finding.