Description
Hi, I searched the issues and could not find anything related, so hopefully this is not a duplicate of something.
Currently OS Hardening sets permissions in roles/os_hardening/tasks/minimize_access.yml in the task "Change passwd ownership to root and mode to 0644 | os-03" for all files passwd, group, passwd- and group- to the same permissions.
From my understanding it would be better to set permissions of passwd- and group- to 600 to restrict access to the files. Currently this is not possible with OS Hardening.
Solution
There should be a variable for setting specific permissions on group- and passwd-. This files should be handled separately from passwd and group. Changing the permissions could be done the same way, but there should be a difference between the specific files.
When setting more restrictive permissions to passwd or group we will get problems with normal users (e.g. whoami will show that username cannot be discovered for the userid). So changing all permissions is not an option (at least on Debian, which I'm testing with).
Alternatives
No response
Additional information
Everything is tested on Debian 13.
Description
Hi, I searched the issues and could not find anything related, so hopefully this is not a duplicate of something.
Currently OS Hardening sets permissions in
roles/os_hardening/tasks/minimize_access.ymlin the task "Change passwd ownership to root and mode to 0644 | os-03" for all filespasswd,group,passwd-andgroup-to the same permissions.From my understanding it would be better to set permissions of
passwd-andgroup-to 600 to restrict access to the files. Currently this is not possible with OS Hardening.Solution
There should be a variable for setting specific permissions on
group-andpasswd-. This files should be handled separately frompasswdandgroup. Changing the permissions could be done the same way, but there should be a difference between the specific files.When setting more restrictive permissions to
passwdorgroupwe will get problems with normal users (e.g.whoamiwill show that username cannot be discovered for the userid). So changing all permissions is not an option (at least on Debian, which I'm testing with).Alternatives
No response
Additional information
Everything is tested on Debian 13.