User umask value is unsafe

InsightVM
1

Tried many different ways to resolve this issue on an Ubuntu 22.04.3 server:

“The umask value was found to be 0022 but was expected to be 0077”

… including editing and setting umask in the following files:

/etc/bashrc
/etc/profile
/etc/login.defs

/root/.bashrc
/root/.profile

When root creates a new file the permissions are correct: -rw------- but Rapid 7 still seems to think the umask is 022

How is Rapid 7 determining the umask value when it does a scan?

2

I can’t answer your question, but we see this vulnerability quite a bit. The vulnerability says “the umask value for the account used to scan this device was found to be unsafe.” We are using the InsightVM Scan Assistant to scan the device which has no direct account on the system or the ability to create files.

1 Like