The default umask for FTP users must be 077.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| low | V-216342 | SRG-OS-000480 | SOL-11.1-040260 | SV-216342r959010_rule | 2024-11-25 | 3 |
| Description |
|---|
| Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. |
| ℹ️ Check |
|---|
| The package service/network/ftp must be installed for this check. # pkg list service/network/ftp If the output of this command is: pkg list: no packages matching 'service/network/ftp' installed no further action is required. Determine if the FTP umask is set to 077. # egrep -i "^UMASK" /etc/proftpd.conf | awk '{ print $2 }' If 077 is not displayed, this is a finding. |
| ✔️ Fix |
|---|
| The root role is required. # pkg list service/network/ftp If the output of this command is: pkg list: no packages matching 'service/network/ftp' installed no further action is required. Otherwise, edit the FTP configuration file. # pfedit /etc/proftpd.conf Locate the line containing: Umask Change the line to read: Umask 077 |