BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-09-232050 All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.

DISA STIG library V2R10
All changes in this version
first version loaded CAT II

Maps to CM-6 via CCI-000366

Title

All RHEL 9 local interactive user home directories must have mode 0750 or less permissive.

Control

Verify the assigned home directory of all local interactive users has a mode of "0750" or less permissive with the following command: Note: This may miss interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. $ stat -L -c '%a %n' $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) 2>/dev/null 700 /home/disauser If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.

Discussion

Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.

Related controls

CCI-000366

Fix

Change the mode of interactive user's home directories to "0750" using the following command: Note: The example will be for the user "disauser". $ sudo chmod 0750 /home/disauser