documentation_complete: true

prodtype: osp7

title: 'Check-Neutron-02: Are strict permissions set for Compute configuration files?'

description: |-
    Similar to the previous check, it is recommended to set strict access permissions for such configuration files.

    <br />
    <br />
    Run the following commands:

    <br />
    <br />
    <tt>
    $ stat -L -c "%a" /etc/neutron/neutron.conf
    <br />
    $ stat -L -c "%a" /etc/neutron/api-paste.ini
    <br />
    $ stat -L -c "%a" /etc/neutron/policy.json
    <br />
    $ stat -L -c "%a" /etc/neutron/rootwrap.conf
    </tt>
    <br />
    <br />
    Pass: If permissions are set to 640 or stricter. The permissions of 640 translates into owner r/w, group r, and no rights to others i.e. &#8220;u=rw,g=r,o=&#8221;. Note that with Check-Neutron-01: Is user/group ownership of config files set to root/neutron? and permissions set to 640, root has read/write access and neutron has read access to these configuration files. The access rights can also be validated using the following command. This command will only be available on your system if it supports ACLs.
    <br />
    <br />
    <tt>
    $ getfacl --tabular -a /etc/neutron/neutron.conf
    <br />
    getfacl: Removing leading '/' from absolute path names
    <br />
    <br />
    # file: etc/neutron/neutron.conf
    <br />
    USER   root     rw-
    <br />
    GROUP  neutron  r--
    <br />
    mask            r--
    <br />
    other           ---
    </tt>
    <br />
    <br />
    Fail: If permissions are not set to at least 640.

rationale: ""

severity: unknown
