Verify Who Owns /etc/shells File

Description

To properly set the owner of /etc/shells, run the command:

$ sudo chown root /etc/shells

Rationale

The /etc/shells file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

if id "0" >/dev/null 2>&1; then
  newown="0"
fi
if [[ -z ${newown} ]]; then
  echo "0 is not a defined user on the system"
  exit 1
fi
chown $newown /etc/shells

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Set the file_owner_etc_shells_newown variable if represented by uid
  set_fact:
    file_owner_etc_shells_newown: '0'
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/shells
  stat:
    path: /etc/shells
  register: file_exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/shells
  file:
    path: /etc/shells
    owner: '{{ file_owner_etc_shells_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed