During my server build I am setting /etc/group-file permission to mode: 0600. After while this permission changes to 644. not sure how its changing.

What is the based way to keep this file permission same all the time?

Thanks SR

  • What is the problem that you're trying to solve by resetting the permissions on /etc/group? Seems a sure-fire way to break use group permissions. – doneal24 Jun 29 '18 at 18:12
  • I want to Hardening the server. – sfgroups Jun 30 '18 at 13:58
  • Why do you think changing perms on /etc/group will achieve any hardening? Security through obscurity argument perhaps? Will you be changing /etc/passwd for the same reasons? No, I don't know what is changing the perms. Only idea I have a a weird SELinux policy - I assume the first this you did to harden the system to turn on SELinux in enforcing mode. – doneal24 Jul 2 '18 at 12:06
  • Its based on CIS standard we have to configure the server. you can see some more details on this page. access.redhat.com/solutions/3190922 – sfgroups Jul 2 '18 at 15:18

If you are talking about /etc/group- that is a back up of the /etc/group file. The permission are probably changing whenever a new backup is generated, like after creating a user or something like that. The default umask value is usually 022 (removes write from group and world) which would result in 644 for new files.

Changing the default umask in /etc/profile is not a good idea. You might want to look at the answer to this post serverfault.com/questions/361665/inherit-or-set-permissions-for-all-new-files-under-a-specific-path.

  • you right, we don't want to change umask, setting setuid bit also not good idea. may be for now I will add cron job to fix this permission issue. – sfgroups Jun 30 '18 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.