Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Writable files and directories

Group and world writable files and directories particularly system files partitions, can be a security hole if a cracker gains access to your system and modifies them. Additionally, world-writable directories are dangerous, since they allow a cracker to add or delete files as he or she wishes in these directories. In the normal course of operation, several files will be writable, including some from the /dev, /var/catman directories, and all symbolic links on your system. To locate all group & world-writable files on your system, use the command:

          # find / -type f \( -perm -2 -o -perm -20 \) -exec ls -lg {} \;
            

          # find / -type d \( -perm -2 -o -perm -20 \) -exec ls -ldg {} \;

General filesystem security rules are very simple and can be formulated as following:

In our environment we blindly reset other bits using a script that is running from cron (or, more correctly, "should reset" ) but in yours such an approach might lead to undesirable effects.

So the following probably will be a more smooth way to proceed:

1. Find all files that have such attributes, excluding those in /tmp, /proc and other pseudo-filesystems (like /var/run in Solaris; I am not a big AIX specialist: I work mostly with Solaris ). For example :

3. [Optional] Reset permissions on all world-writable dot files, suid/sguid files and those files that are located in the root directory ( I am trying to enforce moving root account to /root directory on our severs but we are not here yet) as well as in /opt and /usr subtrees (you can modify those recommendations based on your understanding of the environment).