0052-libusrsbin-priv-/usr/sbin Directory File Permissions Modified
Rule ID
Category
Level
Compatible Versions
Description
- Monitor whether the file permissions in the /usr/sbin directory on the host have been modified.
Scan Frequency
Theoretical Basis
- The /usr/sbin directory contains executable files of critical system commands. If permissions change, it may prevent commands from executing, affecting the system.
Risk Items
Audit Method
- Run the following command on the specified file to verify that Uid and Gid are both 0/root and the permission is 755. For example, using the
ss file:
stat /usr/sbin/users
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
- If it is detected that the file permissions in the /usr/sbin directory have changed, log in to the server as the root user and restore the permissions, then audit this change.
Impact
Default Value
References
CIS Controls