back to labs
STIG: Set a Restrictive Default umask (077)
EasyLinux Security15 minThe brief
New files on this host are created group- and world-readable because the default umask is too permissive. Tighten it to the DISA STIG baseline of 077 (new files owner-only) in two places: the account default in /etc/login.defs and a shell drop-in under /etc/profile.d so interactive shells inherit it. Grading reads the configured umask the way a SCAP scan would.
What you'll do
- UMASK 077 in /etc/login.defs
- A /etc/profile.d drop-in sets umask 077 for interactive shells
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.