/etc/hosts devil permissions by default?

[Jorge Fabregas]

Hello everyone,

I noticed that in all of our 11i servers, the default permission for /etc/hosts is set to 666.

Why such an important file is world-writable by default?

Thanks in advance :)
Jorge

[Gary L. Paveza, Jr.]

I checked all my systems (19) and all of them had it as 644. And that isn't really needed since root can override the write permission - so it can be 444.

What version of 11i? We're running 11iv1 (11.11).

[RAC_1]

Applications.programs would need to inquire about hosts details. So 444 are enought. Change it to 444, 666 are not required.

Anil

[Simon Hargrave]

Are you using an Ignite build with customisations, or perhaps building from an Ignite tape? The default permissions for /etc/hosts on 11i is definately NOT 666 (it's 444 I believe).

[Carlo Corthouts]

The hosts file should never be world writable by default.

Do you know who last made changes to this file? Or is this the state after an installation.

[Franky_1]

Hi,

maybe you have not umask set. By default files are created with 666 so umask "022" will result in 644 - that is what /etc/hosts should normally be

Regards

Franky

[Simon Hargrave · Accepted solution]

I also suggest that you check your system for other world-writable files, since this may indicate one of many holes.

find / -perm -o+w

This should search your server for any other world writable files. You can then decide if they should be or not. Be careful though, as some (bad) applications may depend on this.

[Jeff_Traigle]

You didn't specify which 11i version you're talking about, but the default permissions on my 11.11 system patched through June 2003 are 644. Sounds like someone modified them on yours... or a patch along the way set it incorrectly... or a patch along the way that would have corrected it didn't get applied. I would say chances are better for the first possibility though. In all the years I've been working with HP-UX, I don't recall ever having the defaults from the HP media setting permissions on /etc/hosts to anything other than 644.

[Jeff Schussele]

Hi Jorge,

That's a good question. I'd say someone/something had to have changed it.
Maybe admins are ftp'ing it around?
I checked several systems of ours & found a couple at 666 & the vast majority at 644.
A check of /usr/newconfig/etc/hosts shows it at 444. I believe 644 to be the proper perms.

My 2 cents,
Jeff

[Muthukumar_5]

Admin user changed the permission of that file. It has to be 444 ( readable by ALL ).

You can feel the difference between /etc/nsswitch.files there.

All default system files are given with 444 permission only.

Revoke it to normal. Some admin account known guys may be changed the one.

Regards
Muthu

[Jorge Fabregas]

Hello all,

Wow, thanks all for your replies! I'll give points in a few seconds!

I forgot to say that we're using 11.11. Hmmm I thought that it was the standard permission (after installation) although in fact I can't assure this since I haven't done an installation in months. I just assumed it was after installation because all of our 8 servers had it this way.

I didn't find any chmod command in root's shell history. Maybe it was a patch or the other administrator!

I'll definetely change it to 644.

Thanks for your replies. Now I'm SURE it is not this way after installation.

Jorge

[Jorge Fabregas]

Thanks.