mediumsystemverified ✓rollback-safe
Configure default umask for user accounts
default-umask · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The default umask for all users must be configured to 077 to prevent newly created files and directories from being accessible by other users by default.
Rationale
A weak umask allows users to create world-readable or group-readable files, potentially exposing sensitive information. Setting umask to 077 ensures new files have the most restrictive permissions by default.
Check → Remediate
Checkconfig_value
- delimiter:
- path:
- /etc/login.defs
- key:
- UMASK
- expected:
- {{ login_defs_umask }}
Remediateconfig_set
- path:
- /etc/login.defs
- key:
- UMASK
- value:
- {{ login_defs_umask }}
- separator:
Framework references
STIG
V-281082 / RHEL-10-400325V-230385V-270716 / UBTU-24-300030V-260555 / UBTU-22-412035V-258074 / RHEL-09-412065
NIST 800-53
AC-3CM-6
Live verification
rhel8:checkrhel9:checkubuntu22:checkubuntu24:checkubuntu26:check
#umask#permissions#security