securing oracle linux 9 article 28 managing auditd file accesses

سیستم عامل و زیرساخت Hits: 7

In the previous part, Managing Auditd File Access was completed.

1. CIS Benchmark Requirements (Section 7.1)

This article examines the access permissions and ownership of critical system files, such as those used for user and password management, and reviews files that are missing an owner or have dangerous permissions:

  • 7.1.1 Ensure permissions on /etc/passwd are configured
  • 7.1.2 Ensure permissions on /etc/passwd- are configured
  • 7.1.3 Ensure permissions on /etc/group are configured
  • 7.1.4 Ensure permissions on /etc/group- are configured
  • 7.1.5 Ensure permissions on /etc/shadow are configured
  • 7.1.6 Ensure permissions on /etc/shadow- are configured
  • 7.1.7 Ensure permissions on /etc/gshadow are configured
  • 7.1.8 Ensure permissions on /etc/gshadow- are configured
  • 7.1.9 Ensure permissions on /etc/shells are configured
  • 7.1.10 Ensure permissions on /etc/security/opasswd are configured
  • 7.1.11 Ensure world writable files and directories are secured
  • 7.1.12 Ensure no files or directories without an owner and a group exist
  • 7.1.13 Ensure SUID and SGID files are reviewed

2. Concept and Rationale

Core files such as passwd, shadow, and group form the identity structure of the operating system. Protecting these files, and also identifying orphaned files, world-writable files, and files with special executable bits such as SUID and SGID, is essential to prevent identity information disclosure, password cracking, and unauthorized privilege escalation.

3. Oracle Database Compatibility Review (RAC & Grid)

The access settings for user-related files are fully compatible with Oracle requirements. For example, /etc/passwd with mode 0644 is acceptable, and /etc/shadow is protected with the strict mode 0000.

A very important note applies to 7.1.13: Oracle Database and Grid Infrastructure depend heavily on SUID and SGID binaries, such as the oracle, extjob, and jexec executables. Automatically removing or changing the permissions of these files during hardening may immediately break the cluster or database, leading to errors such as ORA-12546. Therefore, SUID and SGID review must be performed manually, and the paths $ORACLE_HOME and $GRID_HOME must be excluded from destructive inspection.

4. Auditing the Current State (Audit Script)

The following script checks the ownership and permissions of system credential files, and also searches for unowned and world-writable files.

The GitHub path of this script is: modules/audit_28_System_File_Permissions.sh

If you are not familiar with Bash scripting, you may refer to the training provided for database administrators on the site: Bash for Oracle DBAs 

#!/bin/bash
# Script: audit28.sh
# Purpose: Audit System File Permissions (CIS 7.1)

echo "=========================================================================="
echo " CIS Requirement: System File Permissions (CIS 7.1)"
echo " - Ensure permissions on /etc/passwd, /etc/shadow, /etc/group, etc. are configured (CIS 7.1.1 - 7.1.10)."
echo " - Ensure no world-writable files exist (CIS 7.1.11)."
echo " - Ensure no unowned files or directories exist (CIS 7.1.12)."
echo " - Audit SUID/SGID executables (CIS 7.1.13)."
echo " Oracle Context & Exceptions:"
echo " - Oracle requires read access to /etc/passwd (0644 is standard and safe)."
echo " - EXCEPTION: Oracle heavily relies on SUID/SGID binaries (e.g., oracle, extjob)."
echo "   Directories like /u01 MUST be excluded from automated SUID removal."
echo "   World-writable and unowned file checks exclude /u01, /proc, and /sys"
echo "   to prevent accidental damage to the database environment."
echo "=========================================================================="

check_file() {
    local file=$1
    local req_mode=$2
    local req_uid=$3
    local req_gid=$4

    if [ ! -f "$file" ]; then
        echo "[FAIL] $file does not exist."
        return
    fi

    local stat_out=$(stat -c "%a %U %G" "$file")
    read -r mode uid gid <<< "$stat_out"

    local pass=true
    if [ "$mode" != "$req_mode" ] && [ "$mode" -gt "$req_mode" ]; then pass=false; fi
    if [ "$uid" != "$req_uid" ]; then pass=false; fi
    if [[ "$gid" != "$req_gid" && "$gid" != "root" ]]; then pass=false; fi

    if $pass; then
        echo "[PASS] $file (Mode: $mode, Owner: $uid:$gid)"
    else
        echo "[FAIL] $file (Found Mode: $mode, Owner: $uid:$gid | Expected: <=$req_mode, Owner: $req_uid:$req_gid)"
    fi
}

# 7.1.1 to 7.1.10
check_file "/etc/passwd" "644" "root" "root"
check_file "/etc/passwd-" "600" "root" "root"
check_file "/etc/group" "644" "root" "root"
check_file "/etc/group-" "600" "root" "root"
check_file "/etc/shadow" "0" "root" "root"
check_file "/etc/shadow-" "0" "root" "root"
check_file "/etc/gshadow" "0" "root" "root"
check_file "/etc/gshadow-" "0" "root" "root"
check_file "/etc/shells" "644" "root" "root"

if [ -f "/etc/security/opasswd" ]; then
    check_file "/etc/security/opasswd" "600" "root" "root"
else
    echo "[PASS] /etc/security/opasswd does not exist (OK)."
fi

echo "-----------------------------------------------------------------"
echo "Checking for World-Writable, Unowned files, and SUID/SGID..."
echo "(Note: Excluding /proc, /sys, and Oracle homes: /u01)"
echo "-----------------------------------------------------------------"

# World Writable Files
WW_FILES=$(find / -xdev -type f -perm -0002 -print 2>/dev/null | grep -vE "^/proc|^/sys|^/u01")
if [ -z "$WW_FILES" ]; then
    echo "[PASS] No unexpected world-writable files found."
else
    echo "[FAIL] World-writable files found:"
    echo "$WW_FILES" | head -n 5
    echo "  ... (truncated for display)"
fi

# Unowned Files/Directories
UNOWNED=$(find / -xdev \( -nouser -o -nogroup \) -print 2>/dev/null | grep -vE "^/proc|^/sys|^/u01")
if [ -z "$UNOWNED" ]; then
    echo "[PASS] No unowned files/directories found."
else
    echo "[FAIL] Unowned files/directories found:"
    echo "$UNOWNED" | head -n 5
    echo "  ... (truncated for display)"
fi

echo "================================================================="
echo "Audit Complete."
echo "================================================================="

5. Applying the Settings (Remediation Bash Script)

The following script applies secure permissions to authentication-related files. Fixing orphaned files and world-writable files requires case-by-case review by the system administrator.

The GitHub path of this script is: modules/remediate_28_System_File_Permissions.sh 

#!/bin/bash
# Script: remediate_cis_7_1.sh
# Purpose: Fix permissions and ownership for system credential files

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Remediating CIS 7.1..."

chown root:root /etc/passwd /etc/passwd- /etc/group /etc/group- /etc/shadow /etc/shadow- /etc/gshadow /etc/gshadow- /etc/shells /etc/security/opasswd 2>/dev/null

chmod 0644 /etc/passwd
chmod 0600 /etc/passwd-
chmod 0644 /etc/group
chmod 0600 /etc/group-
chmod 0000 /etc/shadow
chmod 0000 /etc/shadow-
chmod 0000 /etc/gshadow
chmod 0000 /etc/gshadow-
chmod 0644 /etc/shells
chmod 0600 /etc/security/opasswd 2>/dev/null || touch /etc/security/opasswd && chmod 0600 /etc/security/opasswd

echo "[+] Basic file permissions applied successfully."
echo "[!] Action Required: You must manually investigate and fix unowned files, world-writable files, and review SUID/SGID binaries (CIS 7.1.11 - 7.1.13)."

In the next part, we will cover Local User and Group Settings.