Verify Permissions on passwd File

Classification:

compliance

Framework:

Control:

Description

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale

If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

chmod u-xs,g-xws,o-xwt /etc/passwd

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Test for existence /etc/passwd
 stat:
 path: /etc/passwd
 register: file\_exists
 tags:
 - CJIS-5.5.2.2
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-8.7.c
 - PCI-DSSv4-7.2.6
 - configure\_strategy
 - file\_permissions\_etc\_passwd
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd
 file:
 path: /etc/passwd
 mode: u-xs,g-xws,o-xwt
 when: file\_exists.stat is defined and file\_exists.stat.exists
 tags:
 - CJIS-5.5.2.2
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-8.7.c
 - PCI-DSSv4-7.2.6
 - configure\_strategy
 - file\_permissions\_etc\_passwd
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed