0078-motd-priv-Ensure motd permissions (-rw-r--r--)¶

Rule ID¶

• 0078-motd-priv

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• After login, the content of the /etc/motd file is displayed to users as the message of the day for authenticated users.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• If the /etc/motd file does not have the correct ownership, unauthorized users may modify it with erroneous or misleading information.

Risk Items¶

• Hacker infiltration

• Data leakage

• Cryptomining risk

• Botnet risk

Audit Method¶

• Run the following command and verify that Uid and Gid are both 0 root and Access is 644:

 # stat /etc/motd
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)

Remediation¶

• Run the following commands to set the permissions of /etc/motd:

# chown root:root /etc/motd
# chmod u-x,go-wx /etc/motd

Impact¶

• None

Default Value¶

• None

References¶

CIS Controls¶

• Version 7 14.6 Protect Information through Access Control Lists Protect all information stored on systems with file system, network share, claims, application, or database-specific access control lists. These controls will enforce the principle that only authorized individuals should have access to information that is necessary for their duties.