Skip to content
ATO Pathways
  Log In

Verify Permissions On /etc/ipsec.secrets File

An XCCDF Rule

Description

To properly set the permissions of /etc/ipsec.secrets, run the command: 

$ sudo chmod 0644 /etc/ipsec.secrets

Rationale

Setting correct permissions on the /etc/ipsec.secrets file is important because this file hosts Libreswan configuration. Protection of this file is critical for system security. Restricting the permissions ensures exclusive control of the Libreswan configuration.

ID
xccdf_org.ssgproject.content_rule_file_permissions_etc_ipsec_secrets
Severity
Medium
References
Updated



Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_secrets

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libreswan' 2>/dev/null | grep -q installed; then

chmod u-xs,g-xws,o-xwt /etc/ipsec.secrets

else