Verify Owner on lastlog Command
An XCCDF Rule
Description
To properly set the owner of /usr/bin/lastlog, run the command:
$ sudo chown root /usr/bin/lastlog
Rationale
Unauthorized disclosure of the contents of the /var/log/lastlog file can reveal system data to attackers, thus compromising its confidentiality.
- ID
- xccdf_org.ssgproject.content_rule_file_ownership_lastlog
- Severity
- Medium
- References
- Updated
Remediation - Ansible
- name: Test for existence /usr/bin/lastlog
stat:
path: /usr/bin/lastlog
register: file_exists
tags:
- DISA-STIG-OL08-00-020263
Remediation - Shell Script
chown 0 /usr/bin/lastlog