Verify Group Ownership of /etc/hosts.allow
An XCCDF Rule
Description
To properly set the group owner of /etc/hosts.allow
, run the command:
$ sudo chgrp root /etc/hosts.allow
Rationale
The /etc/hosts.allow
file is used to control access of clients to daemons in the
server. Insecure groupownership of this file could allow users to grant clients unrestricted
access or no access at all to services in the server.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_etc_hosts_allow
- Severity
- Medium
- Updated
Remediation - Ansible
- name: Test for existence /etc/hosts.allow
stat:
path: /etc/hosts.allow
register: file_exists
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
chgrp 0 /etc/hosts.allow
else