The Leaky Backup Script

The nightly database backup on this host was set up in a hurry, and it shows. The script at /usr/local/bin/db-backup.sh carries the database password right in its text, and the dump it writes to /var/backups/db is readable by every account on the box. Any local user walks away with the credential and the data.

Clean it up like an auditor is watching: the password belongs in a root-only config file at /etc/db-backup.conf (owned root:root, mode 600) that defines DB_PASS and that the script reads (sources) at runtime; the script itself must no longer contain the secret; and the backup directory /var/backups/db (mode 700) and the dump that already exists in it (mode 600) must be closed to everyone but root. The grader inspects file contents, ownership, and exact modes — the way a compliance scan would.