TMA-COS-6.1.1
Ensure permissions on /etc/passwd are configured
MediumLevel 1Automatedcos
Description
The /etc/passwd file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate. It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.
How it is checked
Audit method: Shell command
shell
alt0() { command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat /etc/passwd' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; }; if alt0; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to set permissions on /etc/passwd : # chown root:root /etc/passwd # chmod 644 /etc/passwd
Properties
- Operating systems
- Any
- Tags
- access-controlcontainer-optimized-oscos
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.1.1 Ensure permissions on /etc/passwd are configured
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cos