<Group id="files">
<title>Verify Permissions on Important Files and
Directories</title>
<description>Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</description>

<Group id="permissions_important_account_files">
<title>Verify Permissions on Files with Local Account Information and Credentials</title>
<description>The default restrictive permissions for files which act as
important security databases such as <tt>passwd</tt>, <tt>shadow</tt>,
<tt>group</tt>, and <tt>gshadow</tt> files must be maintained.  Many utilities
need read access to the <tt>passwd</tt> file in order to function properly, but
read access to the <tt>shadow</tt> file allows malicious attacks against system
passwords, and should never be enabled.</description>

<Rule id="file_owner_etc_shadow" severity="medium">
<title>Verify User Who Owns <tt>shadow</tt> File</title>
<description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/shadow" owner="root"/></ocil>
<rationale>The <tt>/etc/shadow</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN001400" />
<oval id="file_owner_etc_shadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_shadow" severity="medium">
<title>Verify Group Who Owns <tt>shadow</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/shadow" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/shadow" group="root"/></ocil>
<rationale>The <tt>/etc/shadow</tt> file stores password hashes. Protection of this file is
critical for system security.</rationale>
<ident stig="GEN001410" />
<oval id="file_groupowner_etc_shadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_shadow" severity="medium">
<title>Verify Permissions on <tt>shadow</tt> File</title>
<description><fileperms-desc-macro file="/etc/shadow" perms="0400"/></description>
<ocil><fileperms-check-macro file="/etc/shadow" perms="-r--------"/></ocil>
<rationale>The <tt>/etc/shadow</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN001420" />
<oval id="file_permissions_etc_shadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_shadow" severity="medium">
<title>Verify Extended ACLs on <tt>shadow</tt> File</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale>The <tt>/etc/shadow</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN001430" />
<oval id="file_permissions_extended_etc_shadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_group" severity="medium">
<title>Verify User Who Owns <tt>group</tt> File</title>
<description><fileowner-desc-macro file="/etc/group" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/group" owner="root"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident stig="GEN001391" />
<oval id="file_owner_etc_group" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_group" severity="medium">
<title>Verify Group Who Owns <tt>group</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/group" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/group" group="root"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident stig="GEN001392" />
<oval id="file_groupowner_etc_group" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_group" severity="medium">
<title>Verify Permissions on <tt>group</tt> File</title>
<description><fileperms-desc-macro file="/etc/group" perms="644"/></description>
<ocil><fileperms-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil>
<rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
<ident stig="GEN001393" />
<oval id="file_permissions_etc_group" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_group" severity="medium">
<title>Verify Extended ACLs on <tt>group</tt> File</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale>The <tt>/etc/group</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN001394" />
<oval id="file_permissions_extended_etc_group" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_gshadow" severity="medium">
<title>Verify User Who Owns <tt>gshadow</tt> File</title>
<description><fileowner-desc-macro file="/etc/gshadow" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/gshadow" owner="root"/></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident stig="GEN000000-LNX001431" />
<oval id="file_owner_etc_gshadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_gshadow" severity="medium">
<title>Verify Group Who Owns <tt>gshadow</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/gshadow" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/gshadow" group="root"/></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident stig="GEN000000-LNX001432" />
<oval id="file_groupowner_etc_gshadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_gshadow" severity="medium">
<title>Verify Permissions on <tt>gshadow</tt> File</title>
<description><fileperms-desc-macro file="/etc/gshadow" perms="0400"/></description>
<ocil><fileperms-check-macro file="/etc/gshadow" perms="-r--------"/></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
<ident stig="GEN000000-LNX001433" />
<oval id="file_permissions_etc_gshadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_gshadow" severity="medium">
<title>Verify Extended ACLs on <tt>gshadow</tt> File</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale>The <tt>/etc/gshadow</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN000000-LNX001434" />
<oval id="file_permissions_extended_etc_gshadow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_passwd" severity="medium">
<title>Verify User Who Owns <tt>passwd</tt> File</title>
<description><fileowner-desc-macro file="/etc/passwd" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil>
<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
<ident stig="GEN001378" />
<oval id="file_owner_etc_passwd" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_passwd" severity="medium">
<title>Verify Group Who Owns <tt>passwd</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/passwd" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/passwd" group="root"/></ocil>
<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
<ident stig="GEN001379" />
<oval id="file_groupowner_etc_passwd" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_passwd" severity="medium">
<title>Verify Permissions on <tt>passwd</tt> File</title>
<description><fileperms-desc-macro file="/etc/passwd" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/passwd" perms="-rw-r--r--"/></ocil>
<rationale>If the <tt>/etc/passwd</tt> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</rationale>
<ident stig="GEN001380" />
<oval id="file_permissions_etc_passwd" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_passwd" severity="medium">
<title>Verify Extended ACLs on <tt>passwd</tt> File</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale>The <tt>/etc/passwd</tt> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
<ident stig="GEN001390" />
<oval id="file_permissions_extended_etc_passwd" />
<ref nist="ECLP-1" disa="225" />
</Rule>
</Group>

<Rule id="file_owner_aliases" severity="high">
<title>Verify User Who Owns <tt>aliases</tt> File</title>
<description><fileowner-desc-macro file="/etc/aliases" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/aliases" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004400" />
<oval id="file_owner_aliases" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_aliases" severity="medium">
<title>Verify Group Who Owns <tt>aliases</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/aliases" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/aliases" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004410" />
<oval id="file_groupowner_aliases" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_aliases" severity="medium">
<title>Verify Permissions on <tt>aliases</tt> File</title>
<description><fileperms-desc-macro file="/etc/aliases" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/aliases" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN004420" />
<oval id="file_permissions_aliases" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_aliases" severity="medium">
<title>Verify Extended ACLs on Aliases</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN004430" />
<oval id="file_permissions_extended_aliases" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_aliases_files" severity="medium">
<title>Verify User Who Owns <tt>aliases</tt> File</title>
<description><fileowner-desc-macro file="/etc/aliases" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/aliases" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004360" />
<oval id="file_owner_aliases_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_aliases_files" severity="medium">
<title>Verify Group Who Owns <tt>aliases</tt> File</title>
<description><filegroupowner-desc-macro file="/etc/aliases" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/aliases" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004370" />
<oval id="file_groupowner_aliases_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_aliases_files" severity="medium">
<title>Verify Permissions on <tt>aliases</tt> File</title>
<description><fileperms-desc-macro file="/etc/aliases" perms="0755"/></description>
<ocil><fileperms-check-macro file="/etc/aliases" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN004380" />
<oval id="file_permissions_aliases_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_aliases_files" severity="medium">
<title>Verify Extended ACLs on Aliases Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN004390" />
<oval id="file_permissions_extended_aliases_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_audio_devices" severity="medium">
<title>Verify User Who Owns Audio Device Files</title>
<description><fileowner-desc-macro file="/dev/audio" owner="root"/></description>
<ocil><fileowner-check-macro file="/dev/audio" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002340" />
<oval id="file_owner_audio_devices" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_audio_devices" severity="medium">
<title>Verify Group Who Owns Audio Device Files</title>
<description><filegroupowner-desc-macro file="/dev/audio" group="root"/></description>
<ocil><filegroupowner-check-macro file="/dev/audio" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002360" />
<oval id="file_groupowner_audio_devices" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_audio_devices" severity="medium">
<title>Verify Permissions on Audio Device Files</title>
<description><fileperms-desc-macro file="/dev/audio" perms="0660"/></description>
<ocil><fileperms-check-macro file="/dev/audio" perms="-rw-rw----"/></ocil>
<rationale></rationale>
<ident stig="GEN002320" />
<oval id="file_permissions_audio_devices" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_audio_devices" severity="medium">
<title>Verify Extended ACLs on Audio Device Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN002330" />
<oval id="file_permissions_extended_audio_devices" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_audit_log" severity="medium">
<title>Verify User Who Owns Audit Log Files</title>
<description><fileowner-desc-macro file="/var/log/audit/audit.log" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/log/audit/audit.log" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002680" />
<oval id="file_owner_audit_log" />
<ref nist="ECTP-1" disa="162" />
</Rule>

<Rule id="file_groupowner_audit_log" severity="medium">
<title>Verify Group Who Owns Audit Log Files</title>
<description><filegroupowner-desc-macro file="/var/log/audit/audit.log" group="root"/></description>
<ocil><filegroupowner-check-macro file="/var/log/audit/audit.log" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002690" />
<oval id="file_groupowner_audit_log" />
<ref nist="ECLP-1,ECTP-1" disa="162,163" />
</Rule>

<Rule id="file_permissions_audit_log" severity="medium">
<title>Verify Permissions on Audit Log Files</title>
<description>
System Audit Log Directory Must Have Mode 0755 or Less Permissive and 
System Audit Logs Must Have Mode 0640 or Less Permissive.
Change the mode of the audit log directory with the following command:
<pre># chmod 0755 <i>/var/log/audit/</i></pre>
Change the mode of the audit log files with the following command:
<pre># chmod 0640 <i>audit_file</i></pre>
</description>
<ocil clause="any are more permissive">
Run the following command to check the mode of the system audit log directory:
<pre>ls -ld /var/log/audit/</pre>
The audit log directory must be mode 0755 or less permissive.
Run the following command to check the mode of the system audit logs:
<pre>ls -l /var/log/audit</pre>
Audit logs must be mode 0640 or less permissive.
</ocil>
<rationale>
If users can write to audit logs, audit trails can be modified or destroyed.
</rationale>
<ident stig="GEN002700" />
<oval id="file_permissions_audit_log" />
<ref nist="ECTP-1" disa="163" />
</Rule>

<Rule id="file_permissions_extended_audit_log" severity="medium">
<title>Verify Extended ACLs on Audit Log Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN002710" />
<oval id="file_permissions_extended_audit_log" />
<ref nist="ECTP-1" disa="163" />
</Rule>

<Rule id="file_owner_audit_tools" severity="low">
<title>Verify User Who Owns Audit Tool Files</title>
<description><fileowner-desc-macro file="/sbin/au*" owner="root"/></description>
<ocil><fileowner-check-macro file="/sbin/au*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002715" />
<oval id="file_owner_audit_tools" />
<ref nist="ECLP-1" disa="1493" />
</Rule>

<Rule id="file_groupowner_audit_tools" severity="low">
<title>Verify Group Who Owns Audit Tool Files</title>
<description><filegroupowner-desc-macro file="/sbin/au*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/sbin/au*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002716" />
<oval id="file_groupowner_audit_tools" />
<ref nist="ECLP-1" disa="1493" />
</Rule>

<Rule id="file_permissions_audit_tools" severity="low">
<title>Verify Permissions on Audit Tool Files</title>
<description><fileperms-desc-macro file="/sbin/au*" perms="0750"/></description>
<ocil><fileperms-check-macro file="/sbin/au*" perms="-rwxr-x---"/></ocil>
<rationale></rationale>
<ident stig="GEN002717" />
<oval id="file_permissions_audit_tools" />
<ref nist="ECLP-1" disa="1493" />
</Rule>

<Rule id="file_permissions_extended_audit_tools" severity="low">
<title>Verify Extended ACLs on Audit Tool Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN002718" />
<oval id="file_permissions_extended_audit_tools" />
<ref nist="ECLP-1" disa="1493" />
</Rule>

<Rule id="file_owner_bin_traceroute" severity="medium">
<title>Verify User Who Owns Traceroute</title>
<description><fileowner-desc-macro file="/bin/traceroute" owner="root"/></description>
<ocil><fileowner-check-macro file="/bin/traceroute" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003960" />
<oval id="file_owner_bin_traceroute" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_bin_traceroute" severity="medium">
<title>Verify Group Who Owns Traceroute</title>
<description><filegroupowner-desc-macro file="/bin/traceroute" group="root"/></description>
<ocil><filegroupowner-check-macro file="/bin/traceroute" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003980" />
<oval id="file_groupowner_bin_traceroute" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_bin_traceroute" severity="medium">
<title>Verify Permissions on Traceroute</title>
<description><fileperms-desc-macro file="/bin/traceroute" perms="0700"/></description>
<ocil><fileperms-check-macro file="/bin/traceroute" perms="-rwx------"/></ocil>
<rationale></rationale>
<ident stig="GEN004000" />
<oval id="file_permissions_bin_traceroute" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_bin_traceroute" severity="medium">
<title>Verify Extended ACLs on Traceroute</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN004010" />
<oval id="file_permissions_extended_bin_traceroute" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_core_dump_dir" severity="low">
<title>Verify User Who Owns Core Dump Directory</title>
<description><fileowner-desc-macro file="/var/crash" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/crash" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003520" />
<oval id="file_owner_core_dump_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_core_dump_dir" severity="low">
<title>Verify Group Who Owns Core Dump Directory</title>
<description><filegroupowner-desc-macro file="/var/crash" group="root"/></description>
<ocil><filegroupowner-check-macro file="/var/crash" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003521" />
<oval id="file_groupowner_core_dump_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_core_dump_dir" severity="low">
<title>Verify Permissions on Core Dump Directory</title>
<description><fileperms-desc-macro file="/var/crash" perms="0700"/></description>
<ocil><fileperms-check-macro file="/var/crash" perms="-rwx------"/></ocil>
<rationale></rationale>
<ident stig="GEN003522" />
<oval id="file_permissions_core_dump_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_core_dump_dir" severity="low">
<title>Verify Extended ACLs on Core Dump Directory</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003523" />
<oval id="file_permissions_extended_core_dump_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_cron_log_files" severity="medium">
<title>Verify Permissions on Cron Log Files</title>
<description><fileperms-desc-macro file="/var/log/cron" perms="0600"/></description>
<ocil><fileperms-check-macro file="/var/log/cron" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN003180" />
<oval id="file_permissions_cron_log_files" />
<ref nist="ECLP-1,ECTP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_cron_log_files" severity="medium">
<title>Verify Extended ACLs on Cron Log Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003190" />
<oval id="file_permissions_extended_cron_log_files" />
<ref nist="ECLP-1,ECTP-1" disa="225" />
</Rule>

<Rule id="file_owner_crontab_dirs" severity="medium">
<title>Verify User Who Owns Crontab Directories</title>
<description><fileowner-desc-macro file="/var/spool/cron" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/spool/cron" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003120" />
<oval id="file_owner_crontab_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_crontab_dirs" severity="medium">
<title>Verify Group Who Owns Crontab Directories</title>
<description><filegroupowner-desc-macro file="/var/spool/cron" group="root"/></description>
<ocil><filegroupowner-check-macro file="/var/spool/cron" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003140" />
<oval id="file_groupowner_crontab_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_crontab_dirs" severity="medium">
<title>Verify Permissions on Crontab Directories</title>
<description><fileperms-desc-macro file="/var/spool/cron" perms="0755"/></description>
<ocil><fileperms-check-macro file="/var/spool/cron" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN003100" />
<oval id="file_permissions_crontab_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_crontab_dirs" severity="medium">
<title>Verify Extended ACLs on Crontab Directories</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003110" />
<oval id="file_permissions_extended_crontab_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_crontab_files" severity="medium">
<title>Verify User Who Owns Crontab Files</title>
<description><fileowner-desc-macro file="/etc/cron*" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/cron*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003040" />
<oval id="file_owner_crontab_files" />
<ref nist="DCSL-1" disa="225" />
</Rule>

<Rule id="file_groupowner_crontab_files" severity="medium">
<title>Verify Group Who Owns Crontab Files</title>
<description><filegroupowner-desc-macro file="/etc/cron*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/cron*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003050" />
<oval id="file_groupowner_crontab_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_crontab_files" severity="medium">
<title>Verify Permissions on Crontab Files</title>
<description><fileperms-desc-macro file="/etc/cron*" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/cron*" perms="-r-x------"/></ocil>
<rationale></rationale>
<ident stig="GEN003080" />
<oval id="file_permissions_crontab_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_crontab_files" severity="medium">
<title>Verify Extended ACLs on Crontab Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003090" />
<oval id="file_permissions_extended_crontab_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_cron_files" severity="medium">
<title>Verify Permissions on Cron Files</title>
<description><fileperms-desc-macro file="/etc/cron*" perms="0700"/></description>
<ocil><fileperms-check-macro file="/etc/cron*" perms="-rwx------"/></ocil>
<rationale></rationale>
<ident stig="GEN003080-2" />
<oval id="file_permissions_cron_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_at_allow" severity="medium">
<title>Verify User Who Owns at.allow</title>
<description><fileowner-desc-macro file="/etc/at.allow" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/at.allow" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003460" />
<oval id="file_owner_etc_at_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_at_allow" severity="medium">
<title>Verify Group Who Owns at.allow</title>
<description><filegroupowner-desc-macro file="/etc/at.allow" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/at.allow" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003470" />
<oval id="file_groupowner_etc_at_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_at_allow" severity="medium">
<title>Verify Permissions on at.allow</title>
<description><fileperms-desc-macro file="/etc/at.allow" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/at.allow" perms="-r-x------"/></ocil>
<rationale></rationale>
<ident stig="GEN003340" />
<oval id="file_permissions_etc_at_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_at_allow" severity="medium">
<title>Verify Extended ACLs on at.allow</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003245" />
<oval id="file_permissions_extended_etc_at_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_at_deny" severity="medium">
<title>Verify User Who Owns at.deny</title>
<description><fileowner-desc-macro file="/etc/at.deny" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/at.deny" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003480" />
<oval id="file_owner_etc_at_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_at_deny" severity="medium">
<title>Verify Group Who Owns at.deny</title>
<description><filegroupowner-desc-macro file="/etc/at.deny" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/at.deny" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003490" />
<oval id="file_groupowner_etc_at_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_at_deny" severity="medium">
<title>Verify Permissions on at.deny</title>
<description><fileperms-desc-macro file="/etc/at.deny" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/at.deny" perms="-r-x------"/></ocil>
<rationale></rationale>
<ident stig="GEN003252" />
<oval id="file_permissions_etc_at_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_at_deny" severity="medium">
<title>Verify Extended ACLs on at.deny</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003255" />
<oval id="file_permissions_extended_etc_at_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_cron_allow" severity="medium">
<title>Verify User Who Owns cron.allow</title>
<description><fileowner-desc-macro file="/etc/cron.allow" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/cron.allow" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003240" />
<oval id="file_owner_etc_cron_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_cron_allow" severity="medium">
<title>Verify Group Who Owns cron.allow</title>
<description><filegroupowner-desc-macro file="/etc/cron.allow" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/cron.allow" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003250" />
<oval id="file_groupowner_etc_cron_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_cron_allow" severity="medium">
<title>Verify Permissions on cron.allow</title>
<description><fileperms-desc-macro file="/etc/cron.allow" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/cron.allow" perms="-r-x------"/></ocil>
<rationale></rationale>
<ident stig="GEN002980" />
<oval id="file_permissions_etc_cron_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_cron_allow" severity="medium">
<title>Verify Extended ACLs on cron.allow</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN002990" />
<oval id="file_permissions_extended_etc_cron_allow" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_cron_deny" severity="medium">
<title>Verify User Who Owns cron.deny</title>
<description><fileowner-desc-macro file="/etc/cron.deny" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/cron.deny" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003260" />
<oval id="file_owner_etc_cron_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_cron_deny" severity="medium">
<title>Verify Group Who Owns cron.deny</title>
<description><filegroupowner-desc-macro file="/etc/cron.deny" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/cron.deny" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003270" />
<oval id="file_groupowner_etc_cron_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_cron_deny" severity="medium">
<title>Verify Permissions on cron.deny</title>
<description><fileperms-desc-macro file="/etc/cron.deny" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/cron.deny" perms="-r-x------"/></ocil>
<rationale></rationale>
<ident stig="GEN003200" />
<oval id="file_permissions_etc_cron_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_cron_deny" severity="medium">
<title>Verify Extended ACLs on cron.deny</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003210" />
<oval id="file_permissions_extended_etc_cron_deny" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_cups_printers_conf" severity="medium">
<title>Verify User Who Owns printers.conf</title>
<description><fileowner-desc-macro file="/etc/cups/printers.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/cups/printers.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003920" />
<oval id="file_owner_etc_cups_printers_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_cups_printers_conf" severity="medium">
<title>Verify Group Who Owns printers.conf</title>
<description><filegroupowner-desc-macro file="/etc/cups/printers.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/cups/printers.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003930" />
<oval id="file_groupowner_etc_cups_printers_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_cups_printers_conf" severity="medium">
<title>Verify Permissions on printers.conf</title>
<description><fileperms-desc-macro file="/etc/cups/printers.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/cups/printers.conf" perms="-r-xr--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN003940" />
<oval id="file_permissions_etc_cups_printers_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_cups_printers_conf" severity="medium">
<title>Verify Extended ACLs on printers.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003950" />
<oval id="file_permissions_extended_etc_cups_printers_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_exports" severity="medium">
<title>Verify User Who Owns Exports</title>
<description><fileowner-desc-macro file="/etc/exports" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/exports" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005740" />
<oval id="file_owner_etc_exports" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_exports" severity="medium">
<title>Verify Group Who Owns Exports</title>
<description><filegroupowner-desc-macro file="/etc/exports" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/exports" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005750" />
<oval id="file_groupowner_etc_exports" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_exports" severity="low">
<title>Verify Permissions on Exports</title>
<description><fileperms-desc-macro file="/etc/exports" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/exports" perms="-r-xr--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN005760" />
<oval id="file_permissions_etc_exports" />
<ref nist="ECCD-1,ECCD-2,ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_exports" severity="low">
<title>Verify Extended ACLs on Exports</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN005770" />
<oval id="file_permissions_extended_etc_exports" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_hosts" severity="medium">
<title>Verify User Who Owns Hosts</title>
<description><fileowner-desc-macro file="/etc/hosts" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/hosts" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001366" />
<oval id="file_owner_etc_hosts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_hosts" severity="medium">
<title>Verify Group Who Owns Hosts</title>
<description><filegroupowner-desc-macro file="/etc/hosts" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/hosts" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001367" />
<oval id="file_groupowner_etc_hosts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_hosts" severity="medium">
<title>Verify Permissions on Hosts</title>
<description><fileperms-desc-macro file="/etc/hosts" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/hosts" perms="-r-xr--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN001368" />
<oval id="file_permissions_etc_hosts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_hosts" severity="medium">
<title>Verify Extended ACLs on Hosts</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001369" />
<oval id="file_permissions_extended_etc_hosts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_ldap_conf" severity="medium">
<title>Verify User Who Owns ldap.conf</title>
<description><fileowner-desc-macro file="/etc/ldap.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/ldap.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008080" />
<oval id="file_owner_etc_ldap_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_ldap_conf" severity="medium">
<title>Verify Group Who Owns ldap.conf</title>
<description><filegroupowner-desc-macro file="/etc/ldap.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/ldap.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008100" />
<oval id="file_groupowner_etc_ldap_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_ldap_conf" severity="medium">
<title>Verify Permissions on ldap.conf</title>
<description><fileperms-desc-macro file="/etc/ldap.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/ldap.conf" perms="-r-xr--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN008060" />
<oval id="file_permissions_etc_ldap_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_ldap_conf" severity="medium">
<title>Verify Extended ACLs on ldap.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN008120" />
<oval id="file_permissions_extended_etc_ldap_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_news_infeed_conf" severity="medium">
<title>Verify Permissions on infeed.conf</title>
<description><fileperms-desc-macro file="/etc/news/infeed.conf" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/news/infeed.conf" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN006280" />
<oval id="file_permissions_etc_news_infeed_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_news_infeed_conf" severity="medium">
<title>Verify Extended ACLs on infeed.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006290" />
<oval id="file_permissions_extended_etc_news_infeed_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_news_incoming_conf" severity="medium">
<title>Verify Permissions on incoming.conf</title>
<description><fileperms-desc-macro file="/etc/news/incoming.conf" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/news/incoming.conf" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN006260" />
<oval id="file_permissions_etc_news_incoming_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_news_incoming_conf" severity="medium">
<title>Verify Extended ACLs on incoming.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006270" />
<oval id="file_permissions_extended_etc_news_incoming_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_news_nnrp_access" severity="medium">
<title>Verify Extended ACLs on nnrp.access</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006310" />
<oval id="file_permissions_extended_etc_news_nnrp_access" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_news_passwd_nntp" severity="medium">
<title>Verify Permissions on passwd.nntp</title>
<description><fileperms-desc-macro file="/etc/news/passwd.nntp" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/news/passwd.nntp" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN006320" />
<oval id="file_permissions_etc_news_passwd_nntp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_news_passwd_nntp" severity="medium">
<title>Verify Extended ACLs on passwd.nntp</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006330" />
<oval id="file_permissions_extended_etc_news_passwd_nntp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_nsswitch_conf" severity="medium">
<title>Verify User Who Owns nsswitch.conf</title>
<description><fileowner-desc-macro file="/etc/nsswitch.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/nsswitch.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001371" />
<oval id="file_owner_etc_nsswitch_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_nsswitch_conf" severity="medium">
<title>Verify Group Who Owns nsswitch.conf</title>
<description><filegroupowner-desc-macro file="/etc/nsswitch.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/nsswitch.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001372" />
<oval id="file_groupowner_etc_nsswitch_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_nsswitch_conf" severity="medium">
<title>Verify Permissions on nsswitch.conf</title>
<description><fileperms-desc-macro file="/etc/nsswitch.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/nsswitch.conf" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN001373" />
<oval id="file_permissions_etc_nsswitch_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_nsswitch_conf" severity="medium">
<title>Verify Extended ACLs on nsswitch.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001374" />
<oval id="file_permissions_extended_etc_nsswitch_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_ntp_conf" severity="medium">
<title>Verify User Who Owns ntp.conf</title>
<description><fileowner-desc-macro file="/etc/ntp.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/ntp.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000250" />
<oval id="file_owner_etc_ntp_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_ntp_conf" severity="medium">
<title>Verify Group Who Owns ntp.conf</title>
<description><filegroupowner-desc-macro file="/etc/ntp.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/ntp.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000251" />
<oval id="file_groupowner_etc_ntp_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_ntp_conf" severity="medium">
<title>Verify Permissions on ntp.conf</title>
<description><fileperms-desc-macro file="/etc/ntp.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/ntp.conf" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN000252" />
<oval id="file_permissions_etc_ntp_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_ntp_conf" severity="medium">
<title>Verify Extended ACLs on ntp.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN000253" />
<oval id="file_permissions_extended_etc_ntp_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_resolv_conf" severity="medium">
<title>Verify User Who Owns resolv.conf</title>
<description><fileowner-desc-macro file="/etc/resolv.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/resolv.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001362" />
<oval id="file_owner_etc_resolv_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_resolv_conf" severity="medium">
<title>Verify Group Who Owns resolv.conf</title>
<description><filegroupowner-desc-macro file="/etc/resolv.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/resolv.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001363" />
<oval id="file_groupowner_etc_resolv_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_resolv_conf" severity="medium">
<title>Verify Permissions on resolv.conf</title>
<description><fileperms-desc-macro file="/etc/resolv.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/resolv.conf" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN001364" />
<oval id="file_permissions_etc_resolv_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_resolv_conf" severity="medium">
<title>Verify Extended ACLs on resolv.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001365" />
<oval id="file_permissions_extended_etc_resolv_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_samba_smb_conf" severity="medium">
<title>Verify User Who Owns smb.conf</title>
<description><fileowner-desc-macro file="/etc/samba/smb.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/samba/smb.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN006100" />
<oval id="file_owner_etc_samba_smb_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_samba_smb_conf" severity="medium">
<title>Verify Group Who Owns smb.conf</title>
<description><filegroupowner-desc-macro file="/etc/samba/smb.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/samba/smb.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN006120" />
<oval id="file_groupowner_etc_samba_smb_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_samba_smb_conf" severity="medium">
<title>Verify Permissions on smb.conf</title>
<description><fileperms-desc-macro file="/etc/samba/smb.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/samba/smb.conf" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN006140" />
<oval id="file_permissions_etc_samba_smb_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_samba_smb_conf" severity="medium">
<title>Verify Extended ACLs on smb.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006150" />
<oval id="file_permissions_extended_etc_samba_smb_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_samba_tdb" severity="medium">
<title>Verify User Who Owns Samba Password Files</title>
<description><fileowner-desc-macro file="/etc/samba/passdb.tdb" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/samba/passdb.tdb" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN006160" />
<oval id="file_owner_etc_samba_tdb" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_samba_tdb" severity="medium">
<title>Verify Group Who Owns Samba Password Files</title>
<description><filegroupowner-desc-macro file="/etc/samba/passdb.tdb" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/samba/passdb.tdb" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN006180" />
<oval id="file_groupowner_etc_samba_tdb" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_samba_tdb" severity="medium">
<title>Verify Permissions on Samba Password Files</title>
<description><fileperms-desc-macro file="/etc/samba/passdb.tdb" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/samba/passdb.tdb" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN006200" />
<oval id="file_permissions_etc_samba_tdb" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_samba_tdb" severity="medium">
<title>Verify Extended ACLs on Samba Password Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN006210" />
<oval id="file_permissions_extended_etc_samba_tdb" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_securetty" severity="medium">
<title>Verify User Who Owns securetty</title>
<description><fileowner-desc-macro file="/etc/securetty" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/securetty" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00640" />
<oval id="file_owner_etc_securetty" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_groupowner_etc_securetty" severity="medium">
<title>Verify Group Who Owns securetty</title>
<description><filegroupowner-desc-macro file="/etc/securetty" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/securetty" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00620" />
<oval id="file_groupowner_etc_securetty" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_securetty" severity="medium">
<title>Verify Permissions on securetty</title>
<description><fileperms-desc-macro file="/etc/securetty" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/securetty" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00660" />
<oval id="file_permissions_etc_securetty" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_owner_etc_security_access_conf" severity="medium">
<title>Verify User Who Owns access.conf</title>
<description><fileowner-desc-macro file="/etc/access.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/access.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00400" />
<oval id="file_owner_etc_security_access_conf" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_groupowner_etc_security_access_conf" severity="medium">
<title>Verify Group Who Owns access.conf</title>
<description><filegroupowner-desc-macro file="/etc/access.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/access.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00420" />
<oval id="file_groupowner_etc_security_access_conf" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_permissions_etc_security_access_conf" severity="medium">
<title>Verify Permissions on access.conf</title>
<description><fileperms-desc-macro file="/etc/access.conf" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/access.conf" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00440" />
<oval id="file_permissions_etc_security_access_conf" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_permissions_extended_etc_security_access_conf" severity="medium">
<title>Verify Extended ACLs on access.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00450" />
<oval id="file_permissions_extended_etc_security_access_conf" />
<ref nist="ECLP-1" disa="225,366" />
</Rule>

<Rule id="file_owner_etc_services" severity="medium">
<title>Verify User Who Owns services</title>
<description><fileowner-desc-macro file="/etc/services" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/services" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003760" />
<oval id="file_owner_etc_services" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_services" severity="medium">
<title>Verify Group Who Owns services</title>
<description><filegroupowner-desc-macro file="/etc/services" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/services" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003770" />
<oval id="file_groupowner_etc_services" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_services" severity="medium">
<title>Verify Permissions on services</title>
<description><fileperms-desc-macro file="/etc/services" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/services" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN003780" />
<oval id="file_permissions_etc_services" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_services" severity="medium">
<title>Verify Extended ACLs on services</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003790" />
<oval id="file_permissions_extended_etc_services" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_skel" severity="medium">
<title>Verify User Who Owns Skeleton Files</title>
<description><fileowner-desc-macro file="/etc/skel/*" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/skel/*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001820" />
<oval id="file_owner_etc_skel" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_skel" severity="medium">
<title>Verify Group Who Owns Skeleton Files</title>
<description><filegroupowner-desc-macro file="/etc/skel/*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/skel/*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001830" />
<oval id="file_groupowner_etc_skel" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_skel" severity="medium">
<title>Verify Permissions on Skeleton Files</title>
<description><fileperms-desc-macro file="/etc/skel/*" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/skel/*" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN001800" />
<oval id="file_permissions_etc_skel" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_skel" severity="medium">
<title>Verify Extended ACLs on Skeleton Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001810" />
<oval id="file_permissions_extended_etc_skel" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_sysctl_conf" severity="medium">
<title>Verify User Who Owns sysctl.conf</title>
<description><fileowner-desc-macro file="/etc/sysctl.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/sysctl.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00480" />
<oval id="file_owner_etc_sysctl_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_sysctl_conf" severity="medium">
<title>Verify Group Who Owns sysctl.conf</title>
<description><filegroupowner-desc-macro file="/etc/sysctl.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/sysctl.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00500" />
<oval id="file_groupowner_etc_sysctl_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_sysctl_conf" severity="medium">
<title>Verify Permissions on sysctl.conf</title>
<description><fileperms-desc-macro file="/etc/sysctl.conf" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/sysctl.conf" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00520" />
<oval id="file_permissions_etc_sysctl_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_sysctl_conf" severity="medium">
<title>Verify Extended ACLs on sysctl.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN000000-LNX00530" />
<oval id="file_permissions_extended_etc_sysctl_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_syslog_conf" severity="medium">
<title>Verify User Who Owns syslog.conf</title>
<description><fileowner-desc-macro file="/etc/syslog.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/syslog.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005400" />
<oval id="file_owner_etc_syslog_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_syslog_conf" severity="medium">
<title>Verify Group Who Owns syslog.conf</title>
<description><filegroupowner-desc-macro file="/etc/syslog.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/syslog.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005420" />
<oval id="file_groupowner_etc_syslog_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_syslog_conf" severity="medium">
<title>Verify Permissions on syslog.conf</title>
<description><fileperms-desc-macro file="/etc/syslog.conf" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/syslog.conf" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN005390" />
<oval id="file_permissions_etc_syslog_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_syslog_conf" severity="medium">
<title>Verify Extended ACLs on syslog.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN005395" />
<oval id="file_permissions_extended_etc_syslog_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_etc_xinetd_conf" severity="medium">
<title>Verify User Who Owns xinetd.conf</title>
<description><fileowner-desc-macro file="/etc/xinetd.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/xinetd.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003720" />
<oval id="file_owner_etc_xinetd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_etc_xinetd_conf" severity="medium">
<title>Verify Group Who Owns xinetd.conf</title>
<description><filegroupowner-desc-macro file="/etc/xinetd.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/xinetd.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003730" />
<oval id="file_groupowner_etc_xinetd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_xinetd_conf" severity="medium">
<title>Verify Permissions on xinetd.conf</title>
<description><fileperms-desc-macro file="/etc/xinetd.conf" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/xinetd.conf" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN003740" />
<oval id="file_permissions_etc_xinetd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_xinetd_conf" severity="medium">
<title>Verify Extended ACLs on xinetd.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003745" />
<oval id="file_permissions_extended_etc_xinetd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_etc_xinetd_dir" severity="medium">
<title>Verify Permissions on xinet.d Directory</title>
<description><fileperms-desc-macro file="/etc/xinet.d/" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/xinet.d/" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN003750" />
<oval id="file_permissions_etc_xinetd_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_etc_xinetd_dir" severity="medium">
<title>Verify Extended ACLs on xinet.d Directory</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003755" />
<oval id="file_permissions_extended_etc_xinetd_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_exports_dirs" severity="medium">
<title>Verify User Who Owns Exports Directories</title>
<description><fileowner-desc-macro file="/etc/exports" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/exports" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005800" />
<oval id="file_owner_exports_dirs" />
<ref nist="ECSC-1" disa="225" />
</Rule>

<Rule id="file_groupowner_exports_dirs" severity="medium">
<title>Verify Group Who Owns Exports Directories</title>
<description><filegroupowner-desc-macro file="/etc/exports" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/exports" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005810" />
<oval id="file_groupowner_exports_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_ftpusers" severity="medium">
<title>Verify User Who Owns ftpusers</title>
<description><fileowner-desc-macro file="/etc/ftpusers" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/ftpusers" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004920" />
<oval id="file_owner_ftpusers" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_ftpusers" severity="medium">
<title>Verify Group Who Owns ftpusers</title>
<description><filegroupowner-desc-macro file="/etc/ftpusers" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/ftpusers" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004930" />
<oval id="file_groupowner_ftpusers" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ftpusers" severity="medium">
<title>Verify Permissions on ftpusers</title>
<description><fileperms-desc-macro file="/etc/ftpusers" perms="0640"/></description>
<ocil><fileperms-check-macro file="/etc/ftpusers" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN004940" />
<oval id="file_permissions_ftpusers" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_ftpusers" severity="medium">
<title>Verify Extended ACLs on ftpusers</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN004950" />
<oval id="file_permissions_extended_ftpusers" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_global_initialization_files" severity="medium">
<title>Verify User Who Owns Global Initialization Files</title>
<description><fileowner-desc-macro file="/etc/profile" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/profile" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001740" />
<oval id="file_owner_global_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_global_initialization_files" severity="medium">
<title>Verify Group Who Owns Global Initialization Files</title>
<description><filegroupowner-desc-macro file="/etc/profile" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/profile" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001760" />
<oval id="file_groupowner_global_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_global_initialization_files" severity="medium">
<title>Verify Permissions on Global Initialization Files</title>
<description><fileperms-desc-macro file="/etc/profile" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/profile" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN001720" />
<oval id="file_permissions_global_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_global_initialization_files" severity="medium">
<title>Verify Extended ACLs on Global Initialization Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001730" />
<oval id="file_permissions_extended_global_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="global_initialization_files_mesg" severity="low">
<title>Verify Messaging is Disabled in Global Initialization Files</title>
<description>No global messaging should be enabled.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001780" />
<oval id="global_initialization_files_mesg" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="file_owner_home_dirs" severity="medium">
<title>Verify User Who Owns Home Directories</title>
<description><fileowner-desc-macro file="/home/*" owner="root"/></description>
<ocil><fileowner-check-macro file="/home/*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001500" />
<oval id="file_owner_home_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_home_dirs" severity="medium">
<title>Verify Group Who Owns Home Directories</title>
<description><filegroupowner-desc-macro file="/home/*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/home/*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001520" />
<oval id="file_groupowner_home_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_home_dirs">
<title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
<description>For each human user of the system, view the
permissions of the user's home directory:
<pre># ls -ld /home/<i>USER</i></pre>
Ensure that the directory is not group-writable and that it
is not world-readable. If necessary, repair the permissions:
<pre># chmod g-w /home/<i>USER</i>
# chmod o-rwx /home/<i>USER</i></pre>
</description>
<ocil clause="the user home directory is group-writable or world-readable">
To ensure the user home directory is not group-writable or world-readable, run the following:
<pre># ls -ld /home/<i>USER</i></pre>
</ocil>
<warning category="general">This action may involve
modifying user home directories. Notify your user community, and
solicit input if appropriate, before making this type of
change.</warning>
<rationale>
User home directories contain many configuration files which
affect the behavior of a user's account. No user should ever have
write permission to another user's home directory. Group shared
directories can be configured in sub-directories or elsewhere in the
filesystem if they are needed. Typically, user home directories
should not be world-readable, as it would disclose file names
to other users. If a subset of users need read access
to one another's home directories, this can be provided using
groups or ACLs.
</rationale>
<ident stig="GEN001480" />
<oval id="file_permissions_home_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_home_dirs" severity="low">
<title>Verify Extended ACLs on Home Directories</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001490" />
<oval id="file_permissions_extended_home_dirs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_home_files" severity="low">
<title>Verify User Who Owns Home Files</title>
<description><fileowner-desc-macro file="/home/*/*" owner="root"/></description>
<ocil><fileowner-check-macro file="/home/*/*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001540" />
<oval id="file_owner_home_files" />
<ref nist="ECCD-1,ECCD-2" disa="225" />
</Rule>

<Rule id="file_groupowner_home_files" severity="medium">
<title>Verify Group Who Owns Home Files</title>
<description><filegroupowner-desc-macro file="/home/*/*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/home/*/*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001550" />
<oval id="file_groupowner_home_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_home_files" severity="low">
<title>Verify Permissions on Home Files</title>
<description><fileperms-desc-macro file="/home/*/*" perms="0750"/></description>
<ocil><fileperms-check-macro file="/home/*/*" perms="-rwxr-x---"/></ocil>
<rationale></rationale>
<ident stig="GEN001560" />
<oval id="file_permissions_home_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_home_files" severity="medium">
<title>Verify Extended ACLs on Home Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001570" />
<oval id="file_permissions_extended_home_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_ldap_cacerts" severity="medium">
<title>Verify User Who Owns LDAP CA Certificates</title>
<description><fileowner-desc-macro file="tls_cacert" owner="root"/></description>
<ocil><fileowner-check-macro file="tls_cacert" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008140" />
<oval id="file_owner_ldap_cacerts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_ldap_cacerts" severity="medium">
<title>Verify Group Who Owns LDAP CA Certificates</title>
<description><filegroupowner-desc-macro file="tls_cacert" group="root"/></description>
<ocil><filegroupowner-check-macro file="tls_cacert" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008160" />
<oval id="file_groupowner_ldap_cacerts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ldap_cacerts" severity="medium">
<title>Verify Permissions on LDAP CA Certificates</title>
<description><fileperms-desc-macro file="tls_cacert" perms="0640"/></description>
<ocil><fileperms-check-macro file="tls_cacert" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN008180" />
<oval id="file_permissions_ldap_cacerts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_ldap_cacerts" severity="medium">
<title>Verify Extended ACLs on LDAP CA Certificates</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN008200" />
<oval id="file_permissions_extended_ldap_cacerts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_ldap_certs" severity="medium">
<title>Verify User Who Owns LDAP Certificates</title>
<description><fileowner-desc-macro file="tls_cert" owner="root"/></description>
<ocil><fileowner-check-macro file="tls_cert" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008220" />
<oval id="file_owner_ldap_certs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_ldap_certs" severity="medium">
<title>Verify Group Who Owns LDAP Certificates</title>
<description><filegroupowner-desc-macro file="tls_cert" group="root"/></description>
<ocil><filegroupowner-check-macro file="tls_cert" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008240" />
<oval id="file_groupowner_ldap_certs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ldap_certs" severity="medium">
<title>Verify Permissions on LDAP Certificates</title>
<description><fileperms-desc-macro file="tls_cert" perms="0640"/></description>
<ocil><fileperms-check-macro file="tls_cert" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN008260" />
<oval id="file_permissions_ldap_certs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_ldap_certs" severity="medium">
<title>Verify Extended ACLs on LDAP Certificates</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN008280" />
<oval id="file_permissions_extended_ldap_certs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_ldap_keys" severity="medium">
<title>Verify User Who Owns LDAP Keys</title>
<description><fileowner-desc-macro file="tls_key" owner="root"/></description>
<ocil><fileowner-check-macro file="tls_key" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008300" />
<oval id="file_owner_ldap_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_ldap_keys" severity="medium">
<title>Verify Group Who Owns LDAP Keys</title>
<description><filegroupowner-desc-macro file="tls_key" group="root"/></description>
<ocil><filegroupowner-check-macro file="tls_key" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN008320" />
<oval id="file_groupowner_ldap_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ldap_keys" severity="medium">
<title>Verify Permissions on LDAP Keys</title>
<description><fileperms-desc-macro file="tls_key" perms="0600"/></description>
<ocil><fileperms-check-macro file="tls_key" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN008340" />
<oval id="file_permissions_ldap_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_ldap_keys" severity="medium">
<title>Verify Extended ACLs on LDAP Keys</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN008360" />
<oval id="file_permissions_extended_ldap_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_local_initialization_files" severity="medium">
<title>Verify User Who Owns Local Initialization Files</title>
<description><fileowner-desc-macro file="~/.bashrc" owner="root"/></description>
<ocil><fileowner-check-macro file="~/.bashrc" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001860" />
<oval id="file_owner_local_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_local_initialization_files" severity="medium">
<title>Verify Group Who Owns Local Initialization Files</title>
<description><filegroupowner-desc-macro file="~/.bashrc" group="root"/></description>
<ocil><filegroupowner-check-macro file="~/.bashrc" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001870" />
<oval id="file_groupowner_local_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_local_initialization_files" severity="medium">
<title>Verify Permissions on Local Initialization Files</title>
<description><fileperms-desc-macro file="~/.bashrc" perms="0740"/></description>
<ocil><fileperms-check-macro file="~/.bashrc" perms="-rwxr-----"/></ocil>
<rationale></rationale>
<ident stig="GEN001880" />
<oval id="file_permissions_local_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_local_initialization_files" severity="medium">
<title>Verify Extended ACLs on Local Initialization Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001890" />
<oval id="file_permissions_extended_local_initialization_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_man_pages" severity="low">
<title>Verify Permissions on Man Pages</title>
<description><fileperms-desc-macro file="/usr/share/man" perms="0644"/></description>
<ocil><fileperms-check-macro file="/usr/share/man" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN001280" />
<oval id="file_permissions_man_pages" />
<ref nist="ECCD-1,ECCD-2" disa="225" />
</Rule>

<Rule id="file_permissions_extended_man_pages" severity="low">
<title>Verify Extended ACLs on Man Pages</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001290" />
<oval id="file_permissions_extended_man_pages" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_mib_files" severity="medium">
<title>Verify Permissions on .Mib Files</title>
<description><fileperms-desc-macro file="*.mib" perms="0640"/></description>
<ocil><fileperms-check-macro file="*.mib" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN005340" />
<oval id="file_permissions_mib_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_mib_files" severity="medium">
<title>Verify Extended ACLs on .Mib Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN005350" />
<oval id="file_permissions_extended_mib_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_root_dir" severity="medium">
<title>Verify Permissions on root Directory</title>
<description><fileperms-desc-macro file="/root" perms="0700"/></description>
<ocil><fileperms-check-macro file="/root" perms="-rwx------"/></ocil>
<rationale></rationale>
<ident stig="GEN000920" />
<oval id="file_permissions_root_dir" />
<ref nist="ECCD-1,ECCD-2" disa="225" />
</Rule>

<Rule id="file_permissions_extended_root_dir" severity="medium">
<title>Verify Extended ACLs on root Directory</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN000930" />
<oval id="file_permissions_extended_root_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_run_control_scripts" severity="medium">
<title>Verify User Who Owns Run Control Scripts</title>
<description><fileowner-desc-macro file="/etc/rc*" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/rc*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001660" />
<oval id="file_owner_run_control_scripts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_run_control_scripts" severity="medium">
<title>Verify Group Who Owns Run Control Scripts</title>
<description><filegroupowner-desc-macro file="/etc/rc*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/rc*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001680" />
<oval id="file_groupowner_run_control_scripts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_run_control_scripts" severity="medium">
<title>Verify Permissions on Run Control Scripts</title>
<description><fileperms-desc-macro file="/etc/rc*" perms="0755"/></description>
<ocil><fileperms-check-macro file="/etc/rc*" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN001580" />
<oval id="file_permissions_run_control_scripts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_run_control_scripts" severity="medium">
<title>Verify Extended ACLs on Run Control Scripts</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001590" />
<oval id="file_permissions_extended_run_control_scripts" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_shell_files" severity="medium">
<title>Verify User Who Owns Shell Files</title>
<description><fileowner-desc-macro file="/etc/shells" owner="root"/></description>
<ocil><fileowner-check-macro file="/etc/shells" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002200" />
<oval id="file_owner_shell_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_shell_files" severity="medium">
<title>Verify Group Who Owns Shell Files</title>
<description><filegroupowner-desc-macro file="/etc/shells" group="root"/></description>
<ocil><filegroupowner-check-macro file="/etc/shells" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN002210" />
<oval id="file_groupowner_shell_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_shell_files" severity="high">
<title>Verify Permissions on Shell Files</title>
<description><fileperms-desc-macro file="/etc/shells" perms="0755"/></description>
<ocil><fileperms-check-macro file="/etc/shells" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN002220" />
<oval id="file_permissions_shell_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_shell_files" severity="medium">
<title>Verify Extended ACLs on Shell Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN002230" />
<oval id="file_permissions_extended_shell_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_smtp_logs" severity="medium">
<title>Verify User Who Owns SMTP Logs</title>
<description><fileowner-desc-macro file="/var/log/mail.log" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/log/mail.log" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN004480" />
<oval id="file_owner_smtp_logs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_smtp_logs" severity="medium">
<title>Verify Permissions on SMTP Logs</title>
<description><fileperms-desc-macro file="/var/log/mail.log" perms="0644"/></description>
<ocil><fileperms-check-macro file="/var/log/mail.log" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN004500" />
<oval id="file_permissions_smtp_logs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_smtp_logs" severity="medium">
<title>Verify Extended ACLs on SMTP Logs</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN004510" />
<oval id="file_permissions_extended_smtp_logs" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_snmpd_conf" severity="medium">
<title>Verify User Who Owns snmpd.conf</title>
<description><fileowner-desc-macro file="snmpd.conf" owner="root"/></description>
<ocil><fileowner-check-macro file="snmpd.conf" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005360" />
<oval id="file_owner_snmpd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_snmpd_conf" severity="medium">
<title>Verify Group Who Owns snmpd.conf</title>
<description><filegroupowner-desc-macro file="snmpd.conf" group="root"/></description>
<ocil><filegroupowner-check-macro file="snmpd.conf" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN005365" />
<oval id="file_groupowner_snmpd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_snmpd_conf" severity="medium">
<title>Verify Permissions on snmpd.conf</title>
<description><fileperms-desc-macro file="snmpd.conf" perms="0644"/></description>
<ocil><fileperms-check-macro file="snmpd.conf" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN005320" />
<oval id="file_permissions_snmpd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_snmpd_conf" severity="medium">
<title>Verify Extended ACLs on snmpd.conf</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN005375" />
<oval id="file_permissions_extended_snmpd_conf" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ssh_private_host_keys" severity="medium">
<title>Verify Permissions on /etc/ssh/*key</title>
<description><fileperms-desc-macro file="/etc/ssh/*key" perms="0600"/></description>
<ocil><fileperms-check-macro file="/etc/ssh/*key" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN005523" />
<oval id="file_permissions_ssh_private_host_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_ssh_public_host_keys" severity="medium">
<title>Verify Permissions on /etc/ssh/*key.pub</title>
<description><fileperms-desc-macro file="/etc/ssh/*key.pub" perms="0644"/></description>
<ocil><fileperms-check-macro file="/etc/ssh/*key.pub" perms="-rw-r--r--"/></ocil>
<rationale></rationale>
<ident stig="GEN005522" />
<oval id="file_permissions_ssh_public_host_keys" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_tftp_binary" severity="high">
<title>Verify Permissions on TFTP Binary</title>
<description><fileperms-desc-macro file="/etc/xinetd.d/tftp" perms="0755"/></description>
<ocil><fileperms-check-macro file="/etc/xinetd.d/tftp" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN005100" />
<oval id="file_permissions_tftp_binary" />
<ref nist="ECPA-1" disa="225" />
</Rule>

<Rule id="file_permissions_usr_bin_ldd" severity="medium">
<title>Verify Permissions on /usr/bin/ldd</title>
<description><fileperms-desc-macro file="/usr/bin/ldd" perms="0000"/></description>
<ocil><fileperms-check-macro file="/usr/bin/ldd" perms="----------"/></ocil>
<rationale></rationale>
<ident stig="GEN007960" />
<oval id="file_permissions_usr_bin_ldd" />
<ref nist="ECSC-1" disa="305" />
</Rule>

<Rule id="file_permissions_usr_sbin_dir" severity="medium">
<title>Verify Permissions on sbin Directory</title>
<description><fileperms-desc-macro file="/usr/sbin/" perms="0755"/></description>
<ocil><fileperms-check-macro file="/usr/sbin/" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN001180" />
<oval id="file_permissions_usr_sbin_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_usr_sbin_dir" severity="medium">
<title>Verify Extended ACLs on sbin Directory</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001190" />
<oval id="file_permissions_extended_usr_sbin_dir" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_var_log" severity="medium">
<title>Verify Permissions on System Logs</title>
<description><fileperms-desc-macro file="/var/log/*" perms="0640"/></description>
<ocil><fileperms-check-macro file="/var/log/*" perms="-rw-r-----"/></ocil>
<rationale></rationale>
<ident stig="GEN001260" />
<oval id="file_permissions_var_log" />
<ref nist="ECTP-1" disa="1314" />
</Rule>

<Rule id="file_permissions_extended_var_log" severity="medium">
<title>Verify Extended ACLs on System Logs</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001270" />
<oval id="file_permissions_extended_var_log" />
<ref nist="ECLP-1,ECTP-1" disa="1314" />
</Rule>

<Rule id="file_owner_var_spool_at" severity="medium">
<title>Verify User Who Owns At Directory</title>
<description><fileowner-desc-macro file="/var/spool/at/" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/spool/at/" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003420" />
<oval id="file_owner_var_spool_at" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_var_spool_at" severity="medium">
<title>Verify Group Who Owns At Directory</title>
<description><filegroupowner-desc-macro file="/var/spool/at/" group="root"/></description>
<ocil><filegroupowner-check-macro file="/var/spool/at/" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN003430" />
<oval id="file_groupowner_var_spool_at" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_var_spool_at" severity="medium">
<title>Verify Permissions on At Directory</title>
<description><fileperms-desc-macro file="/var/spool/at/" perms="0755"/></description>
<ocil><fileperms-check-macro file="/var/spool/at/" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN003400" />
<oval id="file_permissions_var_spool_at" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_var_spool_at" severity="medium">
<title>Verify Extended ACLs on At Directory</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN003410" />
<oval id="file_permissions_extended_var_spool_at" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_owner_var_yp" severity="medium">
<title>Verify User Who Owns YP Files</title>
<description><fileowner-desc-macro file="/var/yp/*" owner="root"/></description>
<ocil><fileowner-check-macro file="/var/yp/*" owner="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001320" />
<oval id="file_owner_var_yp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_groupowner_var_yp" severity="medium">
<title>Verify Group Who Owns YP Files</title>
<description><filegroupowner-desc-macro file="/var/yp/*" group="root"/></description>
<ocil><filegroupowner-check-macro file="/var/yp/*" group="root"/></ocil>
<rationale></rationale>
<ident stig="GEN001340" />
<oval id="file_groupowner_var_yp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_var_yp" severity="medium">
<title>Verify Permissions on YP Files</title>
<description><fileperms-desc-macro file="/var/yp/*" perms="0755"/></description>
<ocil><fileperms-check-macro file="/var/yp/*" perms="-rwxr-xr-x"/></ocil>
<rationale></rationale>
<ident stig="GEN001360" />
<oval id="file_permissions_var_yp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_var_yp" severity="medium">
<title>Verify Extended ACLs on YP Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001361" />
<oval id="file_permissions_extended_var_yp" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_xauthority_files" severity="medium">
<title>Verify Permissions on Xauthority Files</title>
<description><fileperms-desc-macro file=".Xauthority" perms="0600"/></description>
<ocil><fileperms-check-macro file=".Xauthority" perms="-rw-------"/></ocil>
<rationale></rationale>
<ident stig="GEN005180" />
<oval id="file_permissions_xauthority_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Rule id="file_permissions_extended_xauthority_files" severity="medium">
<title>Verify Extended ACLs on Xauthority Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN005190" />
<oval id="file_permissions_extended_xauthority_files" />
<ref nist="ECLP-1" disa="225" />
</Rule>

<Group id="permissions_within_important_dirs">
<title>Verify File Permissions Within Some Important Directories</title>
<description>Some directories contain files whose confidentiality or integrity
is notably important and may also be susceptible to misconfiguration over time, particularly if
unpackaged software is installed. As such,
an argument exists to verify that files' permissions within these directories remain
configured correctly and restrictively.   
</description>

<Rule id="file_permissions_library_dirs" severity="medium">
<title>Verify that Shared Library Files Have Restrictive Permissions</title>
<description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<pre>/lib
/lib64
/usr/lib
/usr/lib64
</pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <tt>/lib/modules</tt>. All files in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<pre># chmod go-w <i>FILE</i></pre>
</description>
<ocil clause="any of these files are group-writable or world-writable">
Shared libraries are stored in the following directories:
<pre>/lib
/lib64
/usr/lib
/usr/lib64
</pre>
To find shared libraries that are group-writable or world-writable,
run the following command for each directory <i>DIR</i> which contains shared libraries:
<pre>$ find <i>DIR</i> -perm /022 -type f</pre>
</ocil>
<rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Restrictive permissions are necessary to protect the integrity of the system.
</rationale>
<ref nist="DCSL-1" disa="1499" />
<oval id="file_permissions_library_dirs" />
<ident stig="GEN001300" />
</Rule>

<Rule id="file_permissions_extended_library_dirs" severity="medium">
<title>Verify Extended ACLs on Shared Library Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001310" />
<oval id="file_permissions_extended_library_dirs" />
<ref nist="ECLP-1" disa="1499" />
</Rule>

<Rule id="file_permissions_binary_dirs" severity="medium">
<title>Verify that System Executables Have Restrictive Permissions</title>
<description>
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
All files in these directories should not be group-writable or world-writable.
If any file <i>FILE</i> in these directories is found
to be group-writable or world-writable, correct its permission with the
following command:
<pre># chmod go-w <i>FILE</i></pre>
</description>
<ocil clause="any system executables are found to be group or world writable">
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
To find system executables that are group-writable or world-writable,
run the following command for each directory <i>DIR</i> which contains system executables:
<pre>$ find <i>DIR</i> -perm /022</pre>
</ocil>
<rationale>System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.
</rationale>
<ref nist="ECLP-1" disa="1499" />
<oval id="file_permissions_binary_dirs" />
<ident stig="GEN001200" />
</Rule>

<Rule id="file_permissions_extended_binary_dirs" severity="medium">
<title>Verify Extended ACLs on Shared Binary Files</title>
<description>No extended ACLs should be applied.</description>
<ocil></ocil>
<rationale></rationale>
<ident stig="GEN001210" />
<oval id="file_permissions_extended_binary_dirs" />
<ref nist="ECLP-1" disa="1499" />
</Rule>

<Rule id="file_owner_binary_dirs" severity="medium">
<title>Verify that System Executables Have Root User Ownership</title>
<description>
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
All files in these directories should be owned by the <tt>root</tt> user.
If any file <i>FILE</i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<pre># chown root <i>FILE</i></pre>
</description>
<ocil clause="any system executables are found to not be owned by root">
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
To find system executables that are not owned by <tt>root</tt>,
run the following command for each directory <i>DIR</i> which contains system executables:
<pre>$ find <i>DIR</i> \! -user root</pre>
</ocil>
<rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.
</rationale>
<ref nist="ECLP-1" disa="1499" />
<oval id="file_owner_binary_dirs" />
<ident stig="GEN001220" />
</Rule>

<Rule id="file_groupowner_binary_dirs" severity="medium">
<title>Verify that System Executables Have Root Group Ownership</title>
<description>
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
All files in these directories should be owned by the <tt>root</tt> user.
If any file <i>FILE</i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<pre># chown root <i>FILE</i></pre>
</description>
<ocil clause="any system executables are found to not be owned by root">
System executables are stored in the following directories by default:
<pre>/bin
/usr/bin
/usr/local/bin
/sbin
/usr/sbin
/usr/local/sbin</pre>
To find system executables that are not owned by <tt>root</tt>,
run the following command for each directory <i>DIR</i> which contains system executables:
<pre>$ find <i>DIR</i> \! -user root</pre>
</ocil>
<rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.
</rationale>
<ref nist="ECLP-1" disa="1499" />
<oval id="file_groupowner_binary_dirs" />
<ident stig="GEN001240" />
</Rule>

</Group>

<Rule id="dir_perms_world_writable_sticky_bits" severity="low">
<title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
<description>When the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
<br/>
To set the sticky bit on a world-writable directory <i>DIR</i>, run the
following command:
<pre># chmod +t <i>DIR</i></pre>
</description>
<ocil clause="any world-writable directories are missing the sticky bit">
To find world-writable directories that lack the sticky bit, run the following command:
<pre># find / -xdev -type d -perm 002 ! -perm 1000</pre>
</ocil>
<rationale>
Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure.
<br/><br/>
The only authorized public directories are those temporary directories supplied with the system, 
or those designed to be temporary file repositories.  The setting is normally reserved for directories 
used by the system, by users for temporary file storage (such as <tt>/tmp</tt>), and for directories 
requiring global read/write access.
</rationale>
<ident stig="GEN002500" />
<oval id="dir_perms_world_writable_sticky_bits" />
<ref nist="ECCD-1,ECCD-2" disa="366" />
</Rule>

<Rule id="file_permissions_unauthorized_world_writable" severity="medium">
<title>Ensure No World-Writable Files Exist</title>
<description>It is generally a good idea to remove global (other) write
access to a file when it is discovered. However, check with
documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be
symptoms of a misconfigured application or user
account.</description>
<ocil clause="there is output">
To find world-writable files, run the following command:
<pre># find / -xdev -type f -perm -002</pre>
</ocil>
<rationale>
Data in world-writable files can be modified by any
user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk
caused by world-writable files.</rationale>
<ident stig="GEN002480" />
<ref nist="ECSC-1" disa="366" />
<oval id="file_permissions_unauthorized_world_writable" />
</Rule>

<Rule id="no_files_unowned_by_user">
<title>Ensure All Files Are Owned by a User</title>
<description>If any files are not owned by a user, then the
cause of their lack of ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate user.
</description>
<ocil clause="files exist that are not owned by a valid user">
The following command will discover and print any
files on local partitions which do not belong to a valid user.
Run it once for each local partition <i>PART</i>:
<pre># find <i>PART</i> -xdev -nouser -print</pre>
</ocil>
<rationale>
Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.
</rationale>
<ident stig="GEN001160" />
<oval id="no_files_unowned_by_user" />
<ref nist="ECCD-1,ECCD-2" disa="366" />
</Rule>

<Rule id="file_permissions_ungroupowned">
<title>Ensure All Files Are Owned by a Group</title>
<description>If any files are not owned by a group, then the
cause of their lack of group-ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group.
</description>
<ocil clause="there is output">
The following command will discover and print any
files on local partitions which do not belong to a valid group.
Run it once for each local partition <i>PART</i>:
<pre># find <i>PART</i> -xdev -nogroup -print</pre>
</ocil>
<rationale>
Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.
</rationale>
<ident stig="GEN001170" />
<oval id="file_permissions_ungroupowned" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="dir_perms_world_writable_system_owned">
<title>Ensure All World-Writable Directories Are Owned by a System Account</title>
<description>All directories in local partitions which are
world-writable should be owned by root or another
system account.  If any world-writable directories are not
owned by a system account, this should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group.
</description>
<ocil clause="there is output">
The following command will discover and print world-writable directories that
are not owned by a system account, given the assumption that only system
accounts have a uid lower than 500.  Run it once for each local partition <i>PART</i>:
<pre># find <i>PART</i> -xdev -type d -perm 0002 -uid +500 -print</pre>
</ocil>
<rationale>
Allowing a user account to own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.
</rationale>
<ident stig="GEN002520" />
<oval id="dir_perms_world_writable_system_owned" />
<ref nist="ECLP-1" disa="225" />
</Rule>
</Group>
