DLPX-86539 CIS: postgres user account settings#776
Closed
dbshah12 wants to merge 1 commit into
Closed
Conversation
dbshah12
force-pushed
the
dlpx/pr/dbshah12/a25c0689-491c-4f22-84e1-4f88d9689162
branch
5 times, most recently
from
fb29910 to
92ed1b0
Compare
dbshah12
force-pushed
the
dlpx/pr/dbshah12/a25c0689-491c-4f22-84e1-4f88d9689162
branch
from
92ed1b0 to
16cb8b2
Compare
Contributor
Author
|
Duplicate of delphix/delphix-platform#499 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Status of the home directory ownership and permissions for the user accounts (non-system users) defined within the /etc/passwd file
A home directory or the login directory is a directory assigned to each user account that serves as the repository to store personal files, directories, programs and the user profiles to set local environment variables. Since each user is accountable for the files stored in their home directory, the respective user must be the owner of the directory and the permissions should be set accordingly. As unrestricted ownership/permissions could allow unauthorized access to files and directories containing sensitive and restricted information, which could lead to privilege escalation exploits. Ownership and permissions for the home directories should be restricted as appropriate to the needs of the business.
We currently have three non-system users:
/var/lib/postgresql (user: postgres): Owner = postgres:postgres, Permissions = drwxr-xr-x/export/home/delphix (user: delphix): Owner = delphix:staff, Permissions = drwxr-xr-x/export/home/cli (user: cli): Owner = cli:staff, Permissions = drwxr-xr-xAll three directories have 755 permissions. This should be 750 for all 3.
Solution
Testing