Verify Who Owns /etc/shells File

Docs > Datadog Security > OOTB Rules > Verify Who Owns /etc/shells File

Description

To properly set the owner of /etc/shells, run the command:

$ sudo chown root /etc/shells

Rationale

The /etc/shells file contains the list of full pathnames to shells on the system. Since this file is used by many system programs this file should be protected.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

chown 0 /etc/shells

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Test for existence /etc/shells
  stat:
    path: /etc/shells
  register: file_exists
  tags:
  - CCE-86622-8
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/shells
  file:
    path: /etc/shells
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CCE-86622-8
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed