================================================================================
  FILESYSTEM ACL AUDIT REPORT
  Host: prod-app-01.acme.internal
  Date: 2025-10-03 14:22:07 UTC
  Auditor: automated-scan (acl-audit v2.4.1)
  Scan scope: critical system files, temp directories, config files
================================================================================


=== SECTION 1: CRITICAL FILE PERMISSIONS ===

--- /etc/shadow ---
# file: etc/shadow
# owner: root
# group: root
user::rw-
group::r--
other::r--

  [CRITICAL] /etc/shadow is world-readable (other::r--)!
  Expected: 0640 (owner: rw-, group: r--, other: ---)
  Risk: Any local user can read password hashes and attempt offline cracking.
  Affected users: 47 accounts including root, admin, deploy, dbadmin


--- /etc/passwd ---
# file: etc/passwd
# owner: root
# group: root
user::rw-
group::r--
other::r--

  [OK] Standard permissions for /etc/passwd.


--- /etc/sudoers ---
# file: etc/sudoers
# owner: root
# group: root
user::rw-
group::rw-
other::r--

  [HIGH] /etc/sudoers is world-readable and group-writable!
  Expected: 0440 (owner: r--, group: r--, other: ---)
  Risk: Group members can modify sudo rules to escalate privileges.
        Any user can read sudoers to understand privilege structure.


--- /etc/ssh/sshd_config ---
# file: etc/ssh/sshd_config
# owner: deploy
# group: deploy
user::rw-
group::rw-
other::r--

  [HIGH] /etc/ssh/sshd_config is owned by 'deploy' (not root)!
  Expected owner: root:root
  Risk: The 'deploy' user can modify SSH daemon config to enable
        password auth, permit root login, add authorized keys, or
        change the listening port.


--- /etc/crontab ---
# file: etc/crontab
# owner: root
# group: staff
user::rw-
group::rw-
other::r--

  [HIGH] /etc/crontab is group-writable by 'staff' group!
  Expected: 0644 with group root
  Risk: Any member of 'staff' can add cron jobs running as root.
  Members of 'staff': jthompson, mrodriguez, intern01, intern02


=== SECTION 2: SUID/SGID BINARIES IN SUSPICIOUS LOCATIONS ===

  [CRITICAL] SUID binaries found in /tmp:

  -rwsr-xr-x  1 root root  16832  2025-09-28 03:14  /tmp/suid-shell
  -rwsr-xr-x  1 root root  27456  2025-10-01 22:47  /tmp/.hidden-util
  -rwsr-sr-x  1 root root  48120  2025-09-15 11:30  /tmp/nmap-wrapper

  [CRITICAL] SUID binaries found in /var/tmp:

  -rwsr-xr-x  1 root root  12288  2025-10-02 04:55  /var/tmp/.update
  -rwsr-xr-x  1 root root   8704  2025-09-20 19:33  /var/tmp/debug-tool

  Total SUID files in temp directories: 5
  Risk: SUID binaries in world-writable directories are a classic
        privilege escalation vector. These may indicate active compromise.


  [WARNING] Unusual SUID binaries in system paths:

  -rwsr-xr-x  1 root root  236456  2025-08-10 14:20  /usr/local/bin/custom-backup
  -rwsr-xr-x  1 root root   52128  2025-07-22 09:15  /usr/local/bin/log-viewer
  -rwsr-sr-x  1 root root  183040  2025-09-05 16:42  /opt/monitoring/collect-stats

  These binaries are SUID root but are not standard system utilities.
  Verify that SUID is required and audit source code.


=== SECTION 3: DIRECTORY PERMISSIONS ===

--- /tmp ---
# file: tmp
# owner: root
# group: root
user::rwx
group::rwx
other::rwx

  [CRITICAL] /tmp is missing the sticky bit!
  Current:  drwxrwxrwx  (0777)
  Expected: drwxrwxrwt  (1777)
  Risk: Without sticky bit, any user can delete or rename files
        owned by other users in /tmp. Enables symlink attacks and
        temp file race conditions.


--- /var/tmp ---
# file: var/tmp
# owner: root
# group: root
# flags: --t
user::rwx
group::rwx
other::rwx

  [OK] /var/tmp has sticky bit set correctly.


--- /opt/application/config ---
# file: opt/application/config
# owner: deploy
# group: www-data
user::rwx
group::rwx
other::r-x

  [HIGH] Application config directory is group-writable by www-data!
  Risk: A compromised web server process (running as www-data) can
        modify application configuration files including:
        - database-credentials.conf
        - api-keys.conf
        - auth-settings.conf


=== SECTION 4: SENSITIVE FILES WITH INCORRECT OWNERSHIP ===

  [HIGH] Files owned by wrong user/group:

  FILE                                    CURRENT OWNER    EXPECTED OWNER
  --------------------------------------------------------------------------
  /etc/ssh/sshd_config                    deploy:deploy    root:root
  /etc/ssl/private/server.key             www-data:www-data root:ssl-cert
  /var/log/auth.log                       syslog:deploy    syslog:adm
  /opt/application/config/db-creds.conf   deploy:www-data  root:app-admin
  /etc/security/access.conf               deploy:staff     root:root
  /opt/backups/db-dump-latest.sql.gz      www-data:www-data root:backup-ops
  /etc/pam.d/common-auth                  deploy:deploy    root:root


=== SECTION 5: GROUP-WRITABLE CONFIGURATION FILES ===

  [HIGH] The following config files are group-writable:

  FILE                                    PERMS     GROUP
  --------------------------------------------------------------------------
  /etc/nginx/nginx.conf                   0664      www-data
  /etc/nginx/sites-enabled/default        0664      www-data
  /etc/mysql/my.cnf                       0664      staff
  /etc/redis/redis.conf                   0664      staff
  /etc/logrotate.conf                     0664      staff
  /opt/application/config/app.yml         0674      www-data
  /opt/application/config/db-creds.conf   0664      www-data

  Risk: Group members can modify service configurations to:
        - Redirect traffic or logs
        - Disable security settings
        - Inject malicious directives
        - Expose credentials


=== SECTION 6: WORLD-WRITABLE FILES ===

  [CRITICAL] World-writable files outside of temp directories:

  -rw-rw-rw-  1 root root      4096  /etc/hosts
  -rw-rw-rw-  1 root root       312  /etc/resolv.conf
  -rwxrwxrwx  1 root root      1847  /usr/local/bin/deploy.sh
  -rw-rw-rw-  1 deploy deploy  8923  /opt/application/config/routes.conf
  -rw-rw-rw-  1 root root      2048  /etc/cron.d/app-tasks

  Risk: Any local user can modify these files.
        /etc/hosts: DNS hijacking for local processes
        /etc/resolv.conf: Redirect DNS queries to attacker-controlled server
        deploy.sh: Inject commands into deployment pipeline
        cron.d/app-tasks: Schedule arbitrary commands


=== SUMMARY ===

  Critical findings:   6
  High findings:       8
  Warning findings:    3
  OK:                  2

  OVERALL STATUS: FAIL

  Recommended immediate actions:
  1. Fix /etc/shadow permissions:     chmod 640 /etc/shadow
  2. Remove SUID binaries from /tmp:  find /tmp /var/tmp -perm -4000 -delete
  3. Set sticky bit on /tmp:          chmod +t /tmp
  4. Fix ownership on sshd_config:    chown root:root /etc/ssh/sshd_config
  5. Remove world-writable flags:     chmod o-w on all flagged files
  6. Investigate SUID binaries in /tmp for signs of compromise

================================================================================
  END OF AUDIT REPORT
================================================================================
