Detections
Analytics

6.2.11 Ensure local interactive user dot files access is configured

Information

While the system administrator can establish secure permissions for users' "dot" files, the users can easily override these.

 - .forward file specifies an email address to forward the user's mail to.
 - .rhost file provides the "remote authentication" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)
 - .netrc file contains data for logging into a remote host or passing authentication to an API.
 - .sh_history or .history file keeps track of the user's last commands.

User configuration files with excessive or incorrect access may enable malicious users to steal or modify other users' data or to gain another user's system privileges.

Solution

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken following site policy.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 668dd0b4b2a0f0400316d221e7153729c0d2c47706767d1074c4e2842f782cc8