[Bug 1923262] Re: backup /etc/passwd- file should be mode 0600

[Serge Hallyn]

I appreciate you bringing this to our attention, but (as shadow upstream
maintainer) I'm going to join John in saying this should be wontfix.

Now if you want to change the subject to also making /etc/passwd 600,
then as Alexander points out that may be doable and have merit.  But
just hiding the backup file doesn't make sense, and as it would require
extra code in the already fiddly backup code in shadow, there is
regression concern.

** Changed in: shadow (Ubuntu)
       Status: Confirmed => Won't Fix

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shadow in Ubuntu.
https://bugs.launchpad.net/bugs/1923262

Title:
  backup /etc/passwd- file should be mode 0600

Status in shadow package in Ubuntu:
  Won't Fix

Bug description:
  CIS hardening benchmarks (6.1.6) suggest that the /etc/passwd- file
  should be mode 0600 (or more restrictive).

  However, this file is 0644 after it is created when the /etc/passwd
  file is modified. (Ie, a hardening script that creates a hardened
  system for initial use could change this mode, but it will go out of
  compliance the next time a backup file is made.)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1923262/+subscriptions