0052-libusrsbin-priv-File permissions modified in /usr/sbin directory
Rule ID
Category
Severity
Compatible Versions
Description
- Monitors whether file permissions in the /usr/sbin directory on the host have been modified
Scan Frequency
Rationale
- The /usr/sbin directory contains executable files for essential system commands. If permissions are changed, commands may fail to execute, affecting the system.
Risk Items
Audit Method
- Run the following command on the specified file, using
ss as an example, and verify that the Uid and Gid are both 0/root and the permissions are 755:
stat /usr/sbin/users
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
- If file permissions in the /usr/sbin directory are detected as changed, log in as root on the server, restore the permissions, and audit the change.
Impact
Default Value
References
CIS Controls