STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must have system commands group-owned by root or a system account.

DISA Rule

SV-270703r1066598_rule

Vulnerability Number

V-270703

Group Title

SRG-OS-000259-GPOS-00100

Rule Version

UBTU-24-300013

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Configure the system commands to be protected from unauthorized access. Run the following command, replacing "[FILE]" with any system command file not group-owned by "root" or a required system account:

$ sudo chgrp [SYSTEMACCOUNT] [FILE]

Check Contents

Verify the system commands contained in the following directories are group-owned by root or a required system account with the following command:

$ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin \-type f -perm -u=x -exec stat --format="%n %G" {} + | \awk '$2 != "root" && $2 != "daemon" && $2 != "adm" && $2 != "shadow" && $2 != "mail" && $2 != "crontab" && $2 != "_ssh"'

Note: The above command uses awk to filter out common system accounts. If your system uses other required system accounts, add them to the awk condition to filter them out of the results.

If any system commands are returned that are not group-owned by a required system account, this is a finding.

Vulnerability Number

V-270703

Documentable

False

Rule Version

UBTU-24-300013

Severity Override Guidance

Verify the system commands contained in the following directories are group-owned by root or a required system account with the following command:

$ find /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin \-type f -perm -u=x -exec stat --format="%n %G" {} + | \awk '$2 != "root" && $2 != "daemon" && $2 != "adm" && $2 != "shadow" && $2 != "mail" && $2 != "crontab" && $2 != "_ssh"'

Note: The above command uses awk to filter out common system accounts. If your system uses other required system accounts, add them to the awk condition to filter them out of the results.

If any system commands are returned that are not group-owned by a required system account, this is a finding.

Check Content Reference

M

Target Key

5673