Detections
Analytics

7.2.9 Ensure local interactive user dot files access is configured

Information

While the system administrator can establish secure permissions for users' "dot" files, the users can easily override these.

 - .forward file specifies an email address to forward the user's mail to.
 - .rhost file provides the "remote authentication" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)
 - .netrc file contains data for logging into a remote host or passing authentication to an API.
 - .bash_history file keeps track of the user's commands.

User configuration files with excessive or incorrect access may enable malicious users to steal or modify other users' data or to gain another user's system privileges.

Solution

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Establish a monitoring policy to report user dot-file permissions and ownership, and take action in accordance with local site policy.

For each file reported by the Audit Procedure, in the affected user's home directory, apply the corresponding action:

 - A .forward or .rhosts file exists - review its contents and remove it:

# rm <file>

 - The file is more permissive than allowed - remove the excess permissions (0600 or more restrictive for .netrc and .bash_history, 0644 or more restrictive for other dot files):

# chmod u-x,go-rwx <file> # .netrc and .bash_history
# chmod u-x,go-wx <file> # other dot files

 - The file is not owned by its user - set the owner:

# chown <user> <file>

 - The file is not group-owned by the user's primary group - set the group:

# chgrp <group> <file>

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 4f8c47db31543677f811bce42485e2c2748c2786dc301c09e8128255de109096