================================================================================ FILESYSTEM ACL AUDIT REPORT Host: prod-app-01.acme.internal Date: 2025-10-03 14:22:07 UTC Auditor: automated-scan (acl-audit v2.4.1) Scan scope: critical system files, temp directories, config files ================================================================================ === SECTION 1: CRITICAL FILE PERMISSIONS === --- /etc/shadow --- # file: etc/shadow # owner: root # group: root user::rw- group::r-- other::r-- [CRITICAL] /etc/shadow is world-readable (other::r--)! Expected: 0640 (owner: rw-, group: r--, other: ---) Risk: Any local user can read password hashes and attempt offline cracking. Affected users: 47 accounts including root, admin, deploy, dbadmin --- /etc/passwd --- # file: etc/passwd # owner: root # group: root user::rw- group::r-- other::r-- [OK] Standard permissions for /etc/passwd. --- /etc/sudoers --- # file: etc/sudoers # owner: root # group: root user::rw- group::rw- other::r-- [HIGH] /etc/sudoers is world-readable and group-writable! Expected: 0440 (owner: r--, group: r--, other: ---) Risk: Group members can modify sudo rules to escalate privileges. Any user can read sudoers to understand privilege structure. --- /etc/ssh/sshd_config --- # file: etc/ssh/sshd_config # owner: deploy # group: deploy user::rw- group::rw- other::r-- [HIGH] /etc/ssh/sshd_config is owned by 'deploy' (not root)! Expected owner: root:root Risk: The 'deploy' user can modify SSH daemon config to enable password auth, permit root login, add authorized keys, or change the listening port. --- /etc/crontab --- # file: etc/crontab # owner: root # group: staff user::rw- group::rw- other::r-- [HIGH] /etc/crontab is group-writable by 'staff' group! Expected: 0644 with group root Risk: Any member of 'staff' can add cron jobs running as root. Members of 'staff': jthompson, mrodriguez, intern01, intern02 === SECTION 2: SUID/SGID BINARIES IN SUSPICIOUS LOCATIONS === [CRITICAL] SUID binaries found in /tmp: -rwsr-xr-x 1 root root 16832 2025-09-28 03:14 /tmp/suid-shell -rwsr-xr-x 1 root root 27456 2025-10-01 22:47 /tmp/.hidden-util -rwsr-sr-x 1 root root 48120 2025-09-15 11:30 /tmp/nmap-wrapper [CRITICAL] SUID binaries found in /var/tmp: -rwsr-xr-x 1 root root 12288 2025-10-02 04:55 /var/tmp/.update -rwsr-xr-x 1 root root 8704 2025-09-20 19:33 /var/tmp/debug-tool Total SUID files in temp directories: 5 Risk: SUID binaries in world-writable directories are a classic privilege escalation vector. These may indicate active compromise. [WARNING] Unusual SUID binaries in system paths: -rwsr-xr-x 1 root root 236456 2025-08-10 14:20 /usr/local/bin/custom-backup -rwsr-xr-x 1 root root 52128 2025-07-22 09:15 /usr/local/bin/log-viewer -rwsr-sr-x 1 root root 183040 2025-09-05 16:42 /opt/monitoring/collect-stats These binaries are SUID root but are not standard system utilities. Verify that SUID is required and audit source code. === SECTION 3: DIRECTORY PERMISSIONS === --- /tmp --- # file: tmp # owner: root # group: root user::rwx group::rwx other::rwx [CRITICAL] /tmp is missing the sticky bit! Current: drwxrwxrwx (0777) Expected: drwxrwxrwt (1777) Risk: Without sticky bit, any user can delete or rename files owned by other users in /tmp. Enables symlink attacks and temp file race conditions. --- /var/tmp --- # file: var/tmp # owner: root # group: root # flags: --t user::rwx group::rwx other::rwx [OK] /var/tmp has sticky bit set correctly. --- /opt/application/config --- # file: opt/application/config # owner: deploy # group: www-data user::rwx group::rwx other::r-x [HIGH] Application config directory is group-writable by www-data! Risk: A compromised web server process (running as www-data) can modify application configuration files including: - database-credentials.conf - api-keys.conf - auth-settings.conf === SECTION 4: SENSITIVE FILES WITH INCORRECT OWNERSHIP === [HIGH] Files owned by wrong user/group: FILE CURRENT OWNER EXPECTED OWNER -------------------------------------------------------------------------- /etc/ssh/sshd_config deploy:deploy root:root /etc/ssl/private/server.key www-data:www-data root:ssl-cert /var/log/auth.log syslog:deploy syslog:adm /opt/application/config/db-creds.conf deploy:www-data root:app-admin /etc/security/access.conf deploy:staff root:root /opt/backups/db-dump-latest.sql.gz www-data:www-data root:backup-ops /etc/pam.d/common-auth deploy:deploy root:root === SECTION 5: GROUP-WRITABLE CONFIGURATION FILES === [HIGH] The following config files are group-writable: FILE PERMS GROUP -------------------------------------------------------------------------- /etc/nginx/nginx.conf 0664 www-data /etc/nginx/sites-enabled/default 0664 www-data /etc/mysql/my.cnf 0664 staff /etc/redis/redis.conf 0664 staff /etc/logrotate.conf 0664 staff /opt/application/config/app.yml 0674 www-data /opt/application/config/db-creds.conf 0664 www-data Risk: Group members can modify service configurations to: - Redirect traffic or logs - Disable security settings - Inject malicious directives - Expose credentials === SECTION 6: WORLD-WRITABLE FILES === [CRITICAL] World-writable files outside of temp directories: -rw-rw-rw- 1 root root 4096 /etc/hosts -rw-rw-rw- 1 root root 312 /etc/resolv.conf -rwxrwxrwx 1 root root 1847 /usr/local/bin/deploy.sh -rw-rw-rw- 1 deploy deploy 8923 /opt/application/config/routes.conf -rw-rw-rw- 1 root root 2048 /etc/cron.d/app-tasks Risk: Any local user can modify these files. /etc/hosts: DNS hijacking for local processes /etc/resolv.conf: Redirect DNS queries to attacker-controlled server deploy.sh: Inject commands into deployment pipeline cron.d/app-tasks: Schedule arbitrary commands === SUMMARY === Critical findings: 6 High findings: 8 Warning findings: 3 OK: 2 OVERALL STATUS: FAIL Recommended immediate actions: 1. Fix /etc/shadow permissions: chmod 640 /etc/shadow 2. Remove SUID binaries from /tmp: find /tmp /var/tmp -perm -4000 -delete 3. Set sticky bit on /tmp: chmod +t /tmp 4. Fix ownership on sshd_config: chown root:root /etc/ssh/sshd_config 5. Remove world-writable flags: chmod o-w on all flagged files 6. Investigate SUID binaries in /tmp for signs of compromise ================================================================================ END OF AUDIT REPORT ================================================================================