topic Security RED FLAG For root .profile? in Operating System - HP-UX

Security RED FLAG For root .profile?

joe_91 — Tue, 30 Nov 2004 10:20:52 GMT

Team:

The security software shows RED FLAG for root's .profile. The permission is 400 for .profile with owner as root:sys. here is the error after running the report
/.profile daemon: : GID is sys, expected daemon
/.profile hpdb:ALLBASE: GID is sys, expected other
/.profile www: : GID is sys, expected other

I am not sure how to correct it? Any ideas?

Thanks

Joe.

Re: Security RED FLAG For root .profile?

Fred Ruffet — Tue, 30 Nov 2004 10:30:23 GMT

I don't know why it is said to be related to .profile, but what is displayed is default groups for those users, and they seem not to be correct. You should correct this with this commands :
usermod -g daemon daemon
usermod -g other hpdb
usermod -g other www

This should correct the problem.

Regards,

Fred

Re: Security RED FLAG For root .profile?

Cheryl Griffin — Tue, 30 Nov 2004 10:32:15 GMT

I am not sure how to interpret your report, but you can report on the group id using the following:
# id daemon
# id hpdb
# id www

For example:
# id www
uid=30(www) gid=1(other)

The gid is stored in the /etc/passwd file.
www:*:30:1::/:

Re: Security RED FLAG For root .profile?

Patrick Wallek — Tue, 30 Nov 2004 10:54:15 GMT

I honestly wouldn't worry about it much.

It is flagging the /.profile because the home directory for each of those users is /, thus it will use the same .profile as the root user, whose home dir is also / by default. The default for root's .profile is owner=root and group=sys, thus you're getting the GID is sys for /.profile.

None of those users should be able to login and you normally don't even su to them, at least I never have, so the .profile should never even be used.

I guess you could try setting up a separate home directory for each of those users /hpdb, /daemon, /www and give them their own profile with the expected permissions. I don't think that would effect anything else. It'd just be non-standard.

Re: Security RED FLAG For root .profile?

joe_91 — Tue, 30 Nov 2004 11:04:13 GMT

I am not able to usermod 'coz it says Cannot modify user 'hpdb': Home directory '/' is shared

Joe

Re: Security RED FLAG For root .profile?

joe_91 — Tue, 30 Nov 2004 11:16:09 GMT

how to add the home direcory for these users?

joe

Re: Security RED FLAG For root .profile?

joe_91 — Tue, 30 Nov 2004 11:24:22 GMT

ok super. i added /daemon as the home dir and same way for others and the red is gone. will this have any other impacts?

Joe

Re: Security RED FLAG For root .profile?

Patrick Wallek — Tue, 30 Nov 2004 11:29:41 GMT

I don't think it will impact anything, but I'm not 100% sure. I've never tried it.

Re: Security RED FLAG For root .profile?

Fred Ruffet — Tue, 30 Nov 2004 11:41:21 GMT

On my ref system, those user are affected to / as home. It shouldn't be a problem as long as they never log in... But we never know.
Better replace everything as said. If you can't use usermod, use sam, or, at least vi (oh ! what a bad advice !). If using vi, make sure to copy file before.

Regards,

Fred