documentation_complete: true

prodtype: osp7

title: 'Check-Identity-01: Is user/group ownership of config files set to keystone?'

description: |-
    Configuration files contain critical parameters and information required for smooth functioning of the component. If an unprivileged user, either intentionally or accidentally modifies or deletes any of the parameters or the file itself then it would cause severe availability issues causing a denial of service to the other end users. Thus user and group ownership of such critical configuration files must be set to that component owner.
    <br />
    <br />
    Run the following commands:
    <br />
    <br />
    <tt>
    $ stat -L -c "%U %G" /etc/keystone/keystone.conf | egrep "keystone keystone" <br />
    $ stat -L -c "%U %G" /etc/keystone/keystone-paste.ini | egrep "keystone keystone"<br />
    $ stat -L -c "%U %G" /etc/keystone/policy.json | egrep "keystone keystone"<br />
    $ stat -L -c "%U %G" /etc/keystone/logging.conf | egrep "keystone keystone"<br />
    $ stat -L -c "%U %G" /etc/keystone/ssl/certs/signing_cert.pem | egrep "keystone keystone"<br />
    $ stat -L -c "%U %G" /etc/keystone/ssl/private/signing_key.pem | egrep "keystone keystone"<br />
    $ stat -L -c "%U %G" /etc/keystone/ssl/certs/ca.pem | egrep "keystone keystone"<br />
    </tt>
    <br />
    <br />
    Pass: If user and group ownership of all these config files is set to keystone. The above commands show output of keystone keystone.
    <br />
    <br />
    Fail: If the above commands does not return any output as the user or group ownership might have set to any user other than keystone.

rationale: ""

severity: unknown
