1

I've been getting some alert messages sent by my WHM instance, warning about invalid permissions on my shadow file. However, the actual permissions (0400) seem correct, and the permissions it reports seem to be very large... numbers?

From this morning:

/etc/shadow has non default permissions. Expected: 2401450770, Actual: 0400.
Review the permissions on /etc/shadow to ensure they are safe

From this evening:

/etc/shadow has non default permissions. Expected: 3377602730, Actual: 0400.
Review the permissions on /etc/shadow to ensure they are safe

What do these reported permissions mean, and why is WHM not happy with 0400?

Improve this question
4
  • Which message are you getting: the one in your title or the one(s) in the body of your question?  ... … … …  I don't know what's going on, but here are some observations that might help others: both numbers are multiples of 8 (as is obvious from the fact that their last digits are 0) but not multiples of 16 (note that the penultimate digits are odd).  Also, they are both > 2²⁸ and < 2²⁹.
    – G-Man Says 'Reinstate Monica'
    May 18, 2016 at 6:04
  • Well, no matter how you look at it, WHM (WebHost Manager?) seems to be malfunctioning ever so slightly. Are you yourself responsible for the management software (not “instance”) deployment?
    – Daniel B
    Jun 3, 2016 at 16:21
  • @DanielB Not really, this is a Cloud VPS through a hosting provider. (A Small Orange.) I can definitely shoot them an email, but this is a personal/low-priority server so I was just hoping to learn a bit and see if I couldn't diagnose or resolve the issue on my own. I do have root access to the WHM web interface, but I don't know if that necessarily grants me the ability to upgrade the WHM software itself.
    – Craig Otis
    Jun 3, 2016 at 16:35
  • Well you should definitely contact support. The issue you’re experiencing seems benign, but who knows what else is going on.
    – Daniel B
    Jun 3, 2016 at 18:59

1 Answer 1

Reset to default
1
+100

Looking at source. Try set permissions 0200 or 0600.

sub _check_for_unsafe_permissions {
my ($self) = @_;

my %test_files = (
    '/etc/shadow' => { 'perms' => [ 0200, 0600 ], 'uid' => 0, 'gid' => 0 },
    '/etc/passwd' => { 'perms' => [0644], 'uid' => 0, 'gid' => 0 }
);

for my $file ( keys %test_files ) {
    my $expected_attributes = $test_files{$file};
    my ( $current_mode, $uid, $gid ) = ( stat($file) )[ 2, 4, 5 ];
    my $perms_ok = 0;
    foreach my $allowed_perms ( @{ $expected_attributes->{'perms'} } ) {
        if ( ( $allowed_perms & 07777 ) == ( $current_mode & 07777 ) ) {
            $perms_ok = 1;
            last;
        }
    }
    if ( !$perms_ok ) {
        my $expected_mode = sprintf( "%04o", $expected_attributes->{'perms'} );
        my $actual_mode   = sprintf( "%04o", $current_mode & 07777 );
        $self->add_warn_advice(
            'text'       => ["$file has non default permissions.  Expected: $expected_mode, Actual: $actual_mode."],
            'suggestion' => ["Review the permissions on $file to ensure they are safe"]
        );
    }

    if ( $uid != $expected_attributes->{'uid'} or $gid != $expected_attributes->{'gid'} ) {
        $self->add_warn_advice(
            'text'       => ["$file has non root user and/or group"],
            'suggestion' => ["Review the ownership permissions

The expected permission output should be a 4 character octal formated value but looks like perl's sprint function is improperly displaying the multidimensional array value which is displaying garbage.

Source (The Security Advisor is found within the Security Center of WHM - Cpanel) https://github.com/bdraco/addon_securityadvisor https://github.com/bdraco/addon_securityadvisor/blob/master/pkg/Cpanel/Security/Advisor/Assessors/Permissions.pm

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .