Oracle Linux 5 Security Technical Implementation Guide

The Oracle Linux 5 Security Technical Implementation Guide (V2 R1) has 571 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

571STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R1

CurrentPublished Fri Jan 22 2021

Cron programs must not set the umask to a value less restrictive than 077.

Oracle Linux 5 Security Technical Implementation Guide

Assessment Title

Rule Text

Cron programs must not set the umask to a value less restrictive than 077.

Description

Discussion Text

The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask is often represented as a 4-digit octal number, the first digit representing special access modes is typically ignored or required to be 0.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-218448

Rule

SV-218448r603259_rule

Severity

low

Rule Version

GEN003220

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Determine if there are any crontabs by viewing a long listing of the directory. If there are crontabs, examine them to determine what cron jobs exist. Check for any programs specifying a umask more permissive than 077:

Procedure:

# ls -lL /var/spool/cron

# ls -lL /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
or
# ls -lL /etc/cron.*|grep -v deny

# cat <crontab file>
# grep umask <cron program>

If there are no cron jobs present, this vulnerability is not applicable. If any cron job contains a umask more permissive than 077, this is a finding.

Implementation Procedure

Fix Text

Edit cron script files and modify the umask to 077.

STIG check 286 of 571 in the Oracle Linux 5 STIG checklist

← Previous · V-218447The cron.deny file must not have an extended ACL.Next · V-218449 →The cron.allow file must be owned by root, bin, or sys.