Just joined after using the site as a guest.. (Very Good Stuff in here.. thanks folks.)

I am in the process of hardening a Solaris 10 server using JASS. I also must use DISA Security Checklists (SRR) scripts to test for things that did not get hardened to DISA standards.

One of the things missing is a script that would change all of the permissions on various man pages to be no more permisive than 644.

I know I can do it by manually finding and changing them, but it would be great if someone allready had a script in place.

Thanks again for a great place to browse and learn.

Altamaha

How about just:
find /usr/share/man -type f | xargs chmod 644

you can use chmod -R, always try man page before posting...

Thanx to both of you for your suggestions. I was and am going to be using whatever we discover here as a learning tool to be applied across other directories where permissions need to be changed.

I am wanting to find files that are more permissive than in this case 644 and change them to 644. That would be accomplised by either of your examples I think.

I may need to run my scripts more than once and need only make changes if the files are more permissive than stated, plus I also need to capture the changes in a log for documentation.

I guess I need an ls -l of the directory to get the perms and based on the perms then perform a chmod and >> to a logfile.

Does that make any sense?

Thanks,
JB aka Altamaha

I tried to post this under the Dummies forum in hopes of because it is actually more dumb than security, but I was shut down for double posting.

Now that I am willing to abide by the rules, and after some help from some others on the group, I offer this bit of code hoping that someone can show a better way to get where I am heading.

I am using the suggested fid command, but I do not know how one would use the "greater than" check against the permission bits.

Thank you,
JB aka Altamaha

GNU find at least has some more advanced options for this. Is installing it an option?

Also, even with regular basic old-skool BSD find, I don't really think you need to painstakingly repeat the -type f -- just add parentheses, but note that you have to backslash-escape them because they are special to the shell, too.

Of course, if you want to say "any bit except 4", that is doable too, at least with GNU find:

Also look at find2perl -- its documentation is somewhat terse but if you can't quite say what you want with the bare find(1) options, it might be less frustrating to make minor edits to a generated Perl script. Quick Googling brought up this brief tutorial