Skip to content

0020-profile-Host /etc/profile Modified


Rule ID

  • 0020-profile

Category

  • system

Level

  • warn

Compatible Versions

  • Linux

Description

  • Monitor that the host /etc/profile has been modified.

Scan Frequency

  • disable

Rationale

  • Linux is a multi-user operating system. Each user has a dedicated runtime environment after logging in. Usually each user's default environment is the same, and this default environment is essentially a set of environment variable definitions. Users can customize their own runtime environment by modifying the corresponding system environment variables. Malicious modification of /etc/profile can cause service unavailability.

Risk Items

  • Service unavailable

Audit Method

  • Verify whether the host /etc/profile has been illegally modified. You can execute the following command to verify:
ls -l /etc/profile

Remediation

  • If the host /etc/profile has been modified, please carefully inspect the host environment for any intrusion and change the host user password.

Impact

  • None

Default Value

  • None

References

  • None

CIS Controls

  • None

Feedback

Is this page helpful?