0049-libusrbin-priv-File permissions modified in /usr/bin directory
Rule ID
Category
Level
Compatible Versions
Description
- Monitor whether file permissions in the
/usr/bin directory on the host have been modified.
Scan Frequency
Rationale
- The
/usr/bin directory contains executable files for essential system commands. If permissions are changed, commands may fail to execute, impacting the system.
Risk Items
Audit Method
- Run the following command on the specified file, using
users as an example, and verify that the Uid and Gid are 0/root and the permission is 755:
stat /usr/bin/users
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
- If file permissions under
/usr/bin are detected as changed, log in as root on the server, restore the permissions, and audit the change.
Impact
Default Value
References
CIS Controls