Set "mesg n" as Default for All Users

LowLevel 1Automatedsolaris

Description

The "mesg n" command blocks attempts to use the write or talk commands to contact users at their terminals, but has the side effect of slightly strengthening permissions on the user's tty device. Since write and talk are no longer widely used at most sites, the incremental security increase is worth the loss of functionality. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

How it is checked

Audit method: Shell command

shell

r=compliant; grep -q "^mesg n" /etc/.login 2>/dev/null || r="mesg n missing in /etc/.login"; grep -q "^mesg n" /etc/profile 2>/dev/null || r="mesg n missing in /etc/profile"; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following to implement the recommended state: # cd /etc # for file in profile .login ; do if [ "`grep mesg $file`" ]; then awk '$1 == "mesg" { $2 = "n" } { print }' $file > $file.CIS mv $file.CIS $file else echo mesg n >> $file fi done

Properties

Operating systems: Any
Tags: solarisaccounts
Reference: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 7.5 Set "mesg n" as Default for All Users

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target solaris