doing permission changes for the users

[Elena Leontieva]

Hello,

Working on security remediation I asked all users on the system to remove world-writable permissions on the files/directories they own or justify the need for ww. Some of them being lazy want me as 'root' to do the changes for them. I do not think I should do that. What is your opinion?

Thanks,
Elena.

[A. Clay Stephenson]

Because security is ultimately your responsibility, you should have already had scripts in place that periodically scan your systems and change the mode of the files. My scripts also use a "do_not_change" list to exclude specific files.

[Patrick Wallek · Accepted solution]

If you asked them to do the changes or provide justification, and they haven't, then by all means make the changes yourself. I would provide the users with a deadline, and if they don't respond then take away the world-write permission.

You are right in that you *shouldn't* have to do this yourself, but system security is ultimately your responsibility as the admin.

[Victor BERRIDGE]

Hi Elena,

I would mofify those lazy users profile by adding a adequate umask!


All the best
Victor

[Rick Garland]

Security is the Admin's responsibility. The Admin has the tools to make the umask, to modify anyone's settings, etc.

You as the security officer for the system need to educate the users to hopefully get some assistance from them.

But the last line of defense is you.