Security Information and Event Management (or SIEM) is a subset of the computer security field, where applications and services join forces with security event management and security information management. When united, these disciplines provide significantly improved real-time statistical data and threat analysis of alerts generated by the related applications. The 2021 Internet Security Threat Report from Sophos denotes that are not only the number of attacks on the rise but also the diverse nature of methodologies and vectors of incursions used. This necessitates the fact that adding a SIEM is especially warranted at this time.
An intrusion detection system (or IDS) is a hardware device or software program that observers a network or system for security policy violations or malicious activity. Typically, any activity or intrusion violation is reported to either an administrator or is collected and logged in a central location using a security information and event management system (or SIEM) system. This system is a security-based technology developed initially for detecting exploits and vulnerabilities used against a computer or other target applications.
IDS systems are usually a passive system that monitors and reports issues that need to be investigated. This product differs from an Intrusion Prevention System (or IPS) in the sense that an IPS assumes an active role by monitoring and defending the system against threats. If a prospective danger is seen, the IPS quickly takes action to prevent any detected exploits from occupying and seizing the system.
Zero Trust security is the concept, methodology, and threat model that assumes no user, system, or service operating within a secured internal environment should be automatically trusted. It put forward that every interaction must be verified when trying to connect to a system before being granted access. This concept uses micro-segmentation, and granular edge controls based on user rights, application access levels, service usage, and relation to the location to determine whether to trust a user, machine, or application seeking to access a specific part of an organization.
As you are probably already aware, everything is considered to be a file in Linux. That includes hardware devices, processes, directories, regular files, sockets, links, and so on. Generally, the file system is divided into data blocks and inodes. With that being said, you can think about inodes as a basis of the Linux file system. To explain it more clearly, an Inode is a data structure that stores metadata about every single file on your computer system.
In this tutorial, we will look at several methods that are used to compromise a website. In today’s world, websites use multiple procedures that represent the core functions of a modern business. Whether you have an eCommerce site or a business card site, a website is essential for driving business growth. We can safely state that a website is a unique image of your respective business.
Remote code execution, also known as code injection, is one of the most common ways hackers compromise a website. This term encompasses multiple techniques which have one aspect in common. The attacker passes off their code as legitimate in the server’s eyes, using a data submission method typically reserved for regular users.
Umask, or the user file-creation mode, is a Linux command that is used to assign the default file permission sets for newly created folders and files. The term mask references the grouping of the permission bits, each of which defines how its corresponding permission is set for newly created files. The bits in the mask may be changed by invoking the umask command.
When using the term Umask, we are referring to one of the following two meanings:
The user file creation mode mask that is used to configure the default permissions for newly created files and directories
The command “umask” which is used to set the umask value
As you probably already know, all Unix-based operating systems have a set of properties that are used to define who is allowed to read, write, or execute specific files or directories. There are three categories called “permissions classes” to which these permissions apply, and they are noted as follows.
User: The User, by default, is the owner or creator of a file or folder. The ownership of the new file defaults to this user.
Group: A Group is a set of users that share the same access level or permissions to a file or folder.
Other: The Other group is defined as any user not included in the previous two categories. These users have not created a file or folder, nor do they belong to a specific usergroup. This group includes everyone not identified as a user or as being part of an usergroup. When we set the permission level of a file or folder to Other, it gives permissions level access to anyone that accesses the file or folder.
So, what happens when a user creates new files and directories? The system automatically assigns the following permissions a file if using the touch command.
The complete manpage entry for umask is as follows.
umask [-p] [-S] [mode]
The user file-creation mask is set to mode.
If mode begins with a digit, it is interpreted as an octal number; otherwise it is interpreted as a symbolic mode mask similar to that accepted by chmod(1). If mode is omitted, the current value of the mask is printed.
The -S option causes the mask to be printed in symbolic form; the default output is an octal number.
If the -p option is supplied, and mode is omitted, the output is in a form that may be reused as input. The return status is 0 if the mode was successfully changed or if no mode argument was supplied, and false otherwise.
To view the current umask value, we use the umask command. Running the umask command by itself provide the default permissions that are assigned when a file or folder is created.
[root@host ~]# umask
0022
[root@host ~]#
To change these values, we will use the following command.
[root@host ~]# umask ###
[root@host ~]# umask 022
The ### symbols in the first command are used in lieu of an actual octal number.
Below, we can see the translated values of the octal and how they are related.
Number
Permission
4
read
2
write
1
execute
Read
Write
Execute
Total Value
Symbolic Equivalent:
0
0
0
0
0
0
1
1
x
0
2
0
2
w
0
2
1
3
wx
4
0
0
4
r
4
0
1
5
rx
4
2
0
6
rw
4
2
1
7
rwx
So, when we run a ls command, the octal or symbolic permissions values are shown at the beginning of the output.
The permissions set for the test directory is 755 or ‘rwx’ ‘r-x’ ‘r-x’. The permissions set for the test.txt file is 644 or ‘rw -‘ ‘r – -‘ ‘r – -‘. A dash signifies a 0 value.
Symbolic Headings
--- no permission
--x execute
-w- write
-wx write and execute
r-- read
r-x read and execute
rw- read and write
rwx read, write and execute
Numeric Headings
0 --- no permission
1 --x execute
2 -w- write
3 -wx write and execute
4 r-- read
5 r-x read and execute
6 rw- read and write
7 rwx read, write and execute
How Umask Works
The umask command masks permission levels by qualifying them with a certain value. To explain further how the umask value is applied, we will illustrate with an example. Let’s say that we want to set the default permissions for all new files or folders to 644 and 755. We would then use the following command.
[root@host ~]# umask 022
The number “2” permission (write permission) will be “filtered” from the system’s default permissions of 666 and 777 (hence the name “mask.”) From now on, the system will now assign the default permissions of 644 and 755 on new files and directories. Simply put, to calculate the permission bits for a new file or directory, we just subtract the umask value from the default value, like so.
666 – 022 = 644
777 – 022 = 755
Octal value : Permission
0 : read, write and execute
1 : read and write
2 : read and execute
3 : read only
4 : write and execute
5 : write only
6 : execute only
7 : no permissions
We can use above information to calculate our file permissions. For example, if our umask is set to 077, the permission can be calculated as follows:
Bit
Targeted at
File permission
0
Owner
read, write and execute
7
Group
No permissions
7
World
No permissions
0 : read, write and execute 7 : no permissions 7 : no permissions
A umask of 000 will make newly created directories readable, writable and executable by everyone (the permissions will be 777).
Umask Configuration Location
In most Linux distributions, the umask value can be found and configured in the following locations:
/etc/profile – this is where system-wide default variables are stored
/etc/bash.bashrc – this is where default shell configuration files are stored
Umask Symbols
As noted in the umask man page above, we can use specific symbols to specify permission values we want to set. To preview the currently set umask value in symbols, we use the following command:
umask -S
To change it, we can use the command in which the letters “u,” “g,” and “o” represent the user, group, and other or world, as shown below.
umask u=$, g=$, o=$
When settings permissions this way, we supplement each “$” placeholder with the desired permission symbol(s). The equal “=” sign is not the only operator at our disposal when setting umask with symbolic values. We can use plus “+” and minus “–” operators as well.
The = symbol allows permissions to be enabled, prohibiting unspecified permissions
The + symbol allows permissions to be enabled, ignoring unspecified permissions
The – symbol prohibits permissions from being enabled, ignoring unspecified permissions
Note:
Using spaces after commas won’t work, and bash will display the “invalid symbolic mode operator” error message.
There’s an additional symbol that can be used when we want to set the same permission for all permissions classes at once (user, group, and other), and that is:
umask a=
Conclusion
Now that we better understand the function of the user file mode creation mask, we can put it to good use. Not only does it save us precious time and improve security, but it also provides us with better permission management capabilities.
Get Started Today!
Still have questions about how to utilize umask? Give us a call at 800.580.4985, or open a chat or ticket with us to speak with one of our knowledgeable Solutions Team or an experienced Hosting Advisors today!
Setuid, Setgid and Sticky Bits are special types of Unix/Linux file permission sets that permit certain users to run specific programs with elevated privileges. Ultimately the permissions that are set on a file determine what users can read, write or execute the file. Linux provides more advanced file permissions that allow you to do more specific things with a file, or directory. Typically, these file permissions are used to allow a user to do certain tasks with elevated privileges (allow them to do things they normally are not permitted to do). This is accomplished with three distinct permission settings. They are setuid, setgid, and the sticky bit.
