SSG 0.1-14-14 - user_umask_logindefs
ssg fthfth
ssgtesting1 at yahoo.com
Fri Feb 14 19:19:16 UTC 2014
For SSGID Ensure the Default Umask is Set Correctly in login.defs - (CCE-26371-5), with the usgcb-rhel6-server profile selected from the SCAP stream, when run with SCC 3.1.1.1, may produce a false-positive on a RHEL6V1R2 complaint machine.
The STIG value is 077. The SSG content “Description” also states a value of 077. However the SSG content state requirement is “subexpression must be equal to '027'”
See the following report output:
Ensure the Default Umask is Set Correctly in login.defs
ID: user_umask_logindefs
Result: Fail
Identities: CCE-26371-5
Description: To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows: UMASK 077
Fix Text:
Severity: low
Weight:
Reference:
366
Definitions:
ID: oval:ssg:def:1160
Result: false
Title: Ensure that Users Have Sensible Umask Values in /etc/login.defs
Description: The default umask for all users specified in /etc/login.defs
Class: compliance
Tests:
false (All item-state comparisons must be true.)
false (Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/login.defs file)
Tests:
Test ID: oval:ssg:tst:1161
Result: false
Title: Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/login.defs file
Check Existence: All collected items must exist.
Check: All collected items must match the given state(s).
State Operator: All item-state comparisons must be true.
Object ID: oval:ssg:obj:2134
Object Requirements:
path must be equal to '/etc'
filename must be equal to 'login.defs'
pattern must match the pattern '^[\s]*UMASK[\s]+([^#\s]*)'
instance must be equal to '1'
State ID: oval:ssg:ste:2135
State Requirements:
subexpression must be equal to '027'
Collected Item Properties:
filepath equals '/etc/login.defs'
path equals '/etc'
filename equals 'login.defs'
pattern equals '^[\s]*UMASK[\s]+([^#\s]*)'
instance equals '1'
text equals 'UMASK 077'
subexpression equals '077'
Additional Information: Collected items did not meet the check requirement.
More information about the scap-security-guide
mailing list