SSG 0.1-14-14 - user_umask_logindefs

ssg fthfth ssgtesting1 at yahoo.com
Fri Feb 14 19:19:16 UTC 2014


For SSGID Ensure the Default Umask is Set Correctly in login.defs - (CCE-26371-5), with the usgcb-rhel6-server profile selected from the SCAP stream, when run with SCC 3.1.1.1, may produce a false-positive on a RHEL6V1R2 complaint machine.
The STIG value is 077. The SSG content “Description” also states a value of 077.  However the SSG content state requirement is “subexpression must be equal to '027'”
See the following report output:
Ensure the Default Umask is Set Correctly in login.defs
ID:  user_umask_logindefs
Result:  Fail
Identities:  CCE-26371-5
Description:  To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows: UMASK 077
Fix Text:   
Severity:  low
Weight:   
Reference:  
366
Definitions:  
ID:  oval:ssg:def:1160
Result:  false
Title:  Ensure that Users Have Sensible Umask Values in /etc/login.defs
Description:  The default umask for all users specified in /etc/login.defs
Class:  compliance
Tests:  

    false (All item-state comparisons must be true.)
        false (Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/login.defs file)

Tests:  
Test ID:  oval:ssg:tst:1161
Result:  false
Title:  Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/login.defs file
Check Existence:  All collected items must exist.
Check:  All collected items must match the given state(s).
State Operator:  All item-state comparisons must be true.
Object ID:  oval:ssg:obj:2134
Object Requirements:  

    path must be equal to '/etc'
    filename must be equal to 'login.defs'
    pattern must match the pattern '^[\s]*UMASK[\s]+([^#\s]*)'
    instance must be equal to '1'

State ID:  oval:ssg:ste:2135
State Requirements:  

    subexpression must be equal to '027'

Collected Item Properties:  

    filepath equals '/etc/login.defs'
    path equals '/etc'
    filename equals 'login.defs'
    pattern equals '^[\s]*UMASK[\s]+([^#\s]*)'
    instance equals '1'
    text equals 'UMASK 077'
    subexpression equals '077'

Additional Information:  Collected items did not meet the check requirement.



More information about the scap-security-guide mailing list