Verify Group Ownership of /etc/hosts.allow
An XCCDF Rule
Description
To properly set the group owner of /etc/hosts.allow
, run the command:
$ sudo chgrp root /etc/hosts.allow
Rationale
The /etc/hosts.allow
file is used to control access of clients to daemons in the
server. Insecure groupownership of this file could allow users to grant clients unrestricted
access or no access at all to services in the server.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_etc_hosts_allow
- Severity
- Medium
- Updated
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- configure_strategy
- file_groupowner_etc_hosts_allow
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
chgrp 0 /etc/hosts.allow
else