risk monitoring
Detection type: /etc/bashrc user default permission check
Risk level: medium risk
Configuration recommendations: /etc/bashrc The umask set in the file is 002, which does not meet the requirements. It is recommended to set it to 027
Solution
Find the umask parameter in the /etc/bashrc file and change its original parameter value 002 to 027.
- Open a terminal.
Open the user's .bashrc file with a text editor (such as nano or vi) and run the following command:
vi /etc/bashrc
- Change parameters
In the open file, look for any lines containing umask. If there are multiple umask lines, make sure you modify the correct line.
Changes the value of the umask line from 002 to 027 . You can change the value manually or use the find and replace function in a text editor.
- Save the file and close the text editor
Now when you log back into your terminal session, the user's umask value will change to 027. This will affect the default permission settings for newly created files and directories. Please note that modifying the umask value may have an impact on other users' access to files and directories you create, so make sure you understand the possible impact of your changes.
The difference between umask 002 and 027
The difference between umask 002 and umask 027 is their default permission settings for newly created files and directories.
umask 002The settings are relatively strict. It disables other users' write permissions by default and only retains read permissions. Specifically, for newly created files, umask 002 will set the permissions of other users to read-only, that is, the file owner has read, write, and execute permissions (rwx), while group users and other users only have read permissions (r— x). For the newly created directory, umask 002 will set the permissions of other users to read-only and execute, that is, the directory owner has read, write, and execute permissions (rwx), while the group user and other users only have read and execute permissions (r-x) .
umask 027The settings are relatively loose. It disables other users' write and execution permissions by default, and only retains read permissions. Specifically, for newly created files, umask 027 will set the permissions of other users to read-only, that is, the file owner has read, write, and execute permissions (rwx), while group users and other users only have read permissions (r— x). However, for newly created directories, umask 027 will set the permissions of other users to read-only, that is, the directory owner has read, write, and execute permissions (rwx), while group users and other users only have read permissions (r—x) .
In short, the difference between umask 002 and umask 027 is that they have different default permission settings for newly created directories. Umask 002 is more strict and will disable other users' write permissions and only retain read permissions; while umask 027 is more relaxed and will disable other users' write and execution permissions and only retain read permissions.