Ensure permissions on /etc/shells are configured

MediumLevel 1Automatedfreebsd

Description

/etc/shells is a text file that contains the full pathnames of valid login shells. This file is consulted by chsh and is available to be queried by other programs. It is critical to protect the /etc/shells file from unauthorized access. Although it is protected by default, the file permissions could be changed inadvertently or through malicious actions. Audit: compares `ls -ld` mode (this mode or more restrictive), owner and group with the CIS values.

How it is checked

Audit method: Shell command

shell

r=compliant; for f in /etc/shells; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r--r--' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to remove excess permissions, set owner, and set group on /etc/shells: # chmod u-x,go-wx /etc/shells # chown root:wheel /etc/shells

Properties

Operating systems: Any
Tags: freebsdpermissions
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 6.1.4 Ensure permissions on /etc/shells are configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd