漏洞修复：User umask value is unsafe (unix-umask-unsafe)

描述

The umask value for the account used to scan this device was found to be unsafe. The umask value determines the file permission for newly created files. It specifies the permissions which should not be given by default to the newly created file. Although the default value of umask in most unix systems is 022, it is a common practice to set it to 077 to be safe.

解决方案

查看当前的umask命令

umask

返回非077

编辑bashrc文件

vi ~/.bashrc

修改文本最下方的umask值为 007 如果没有就添加一行

umask 077

生效修改

source ~/.bashrc

再次查看当前的umask

umask

返回077，修改完成，其他home下的用户，也也可以通过修改bashrc文件完成修改

衍生

创建新用户时，修改默认umask

vi /etc/profile.d/set-umask-for-all-users.sh

添加或修改

umask 077

保存即可

参考

To ensure complete access control over newly created files, set the umask value to 077 for root and other user accounts for both interactive and noninteractive processes. The umask value for interactive processes is typically set via PAM. See 'man 8 pam_umask'. For non-interactive processes, /etc/login.defs is a common location for controlling umask on Linux systems. In both cases, you may need to consult your operating system's documentation for the correct file(s) and settings. For Red Hat Enterprise Linux and derivative distributions the umask value is set in /etc/profile and /etc/bashrc shell configuration files. See the Red Hat manual for more details.

https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html