Making global modifications to users' directories without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot directory permissions and determine the action to be taken in accordance with site policy. The following script will, within local interactive users' home directories: - remove excessive permissions on dot directories (max 0750 ; .ssh max 0700 ) - change ownership of dot directories to the user - change group ownership of dot directories to the user's primary group Note: Like the audit, this remediation scopes its action to local interactive users' home directories only and does not traverse the entire filesystem. #!/usr/bin/env bash { l_maxsize="1000" # Maximum number of local interactive users before warning (Default 1,000) l_valid_shells="^($( awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\\\/,g;p}' | paste -s -d '|' - ))$" a_user_and_home=() # Create array with local users and their home directories while read -r l_local_user l_local_user_home; do # Populate array with users and user home location [[ -n "$l_local_user" && -n "$l_local_user_home" ]] && a_user_and_home+=("$l_local_user:$l_local_user_home") done <<< "$(awk -v pat="$l_valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd)" l_asize="${#a_user_and_home[@]}" # Here if we want to look at number of users before proceeding [ "${#a_user_and_home[@]}" -gt "$l_maxsize" ] && printf '%s\n' "" " ** INFO **" \ " - \"$l_asize\" Local interactive users found on the system" \ " - This may be a long running check" "" dir_access_fix() { l_max="$( printf '%o' $(( 0777 & ~$l_mask)) )" if [ $(( $l_mode & $l_mask )) -gt 0 ]; then printf '%s\n' "" " - Directory: \"$l_hddir\" is mode: \"$l_mode\" and should be mode: \"$l_max\" or more restrictive" \ " Updating directory: \"$l_hddir\" to be mode: \"$l_max\" or more restrictive" chmod "$l_change" "$l_hddir" fi if [[ ! "$l_owner" =~ ($l_user) ]]; then printf '%s\n' "" " - Directory: \"$l_hddir\" owned by: \"$l_owner\" and should be owned by \"${l_user//|/ or }\"" \ " Updating directory: \"$l_hddir\" to be owned by \"${l_user//|/ or }\"" chown "$l_user" "$l_hddir" fi if [[ ! "$l_gowner" =~ ($l_group) ]]; then printf '%s\n' "" " - Directory: \"$l_hddir\" group owned by: \"$l_gowner\" and should be group owned by \"${l_group//|/ or }\"" \ " Updating directory: \"$l_hddir\" to be group owned by \"${l_group//|/ or }\"" chgrp "$l_group" "$l_hddir" fi } while IFS=: read -r l_user l_home; do # Skip home directories that reside on a network / remote filesystem l_fstype="$(findmnt -no FSTYPE --target "$l_home" 2>/dev/null)" case "$l_fstype" in nfs|nfs4|cifs|smbfs|smb3|fuse.sshfs|afs|ncpfs|glusterfs|ceph) printf '%s\n' "" " - User: \"$l_user\" Home Directory: \"$l_home\" skipped (remote/network filesystem: $l_fstype)" continue ;; esac if [ -d "$l_home" ]; then l_group="$(id -gn "$l_user" | xargs)";l_group="${l_group// /|}" while IFS= read -r -d $'\0' l_hddir; do while read -r l_mode l_owner l_gowner; do case "$(basename "$l_hddir")" in .ssh ) l_mask='0077'; l_change="g-rwx,o-rwx"; dir_access_fix ;; * ) l_mask='0027'; l_change="g-w,o-rwx"; dir_access_fix ;; esac done < <(stat -Lc '%#a %U %G' "$l_hddir") done < <(find "$l_home" -xdev -type d -name '.*' -print0) fi done <<< "$(printf '%s\n' "${a_user_and_home[@]}")" } Note: This recommendation intentionally avoids a full-filesystem traversal ( find / ) when locating dot directories. A system-wide search for . -prefixed directories is expensive and can take a very long time on hosts with large or networked filesystems, and it would repeatedly cross into directory trees (caches, build artifacts, application data) that are not user credential stores. Instead, the audit and remediation are scoped to the home directories of local interactive users - users who have a valid login shell as enumerated from /etc/passwd and /etc/shells - and use find "$l_home" -xdev -type d -name '.*' (the -xdev guard also keeps the scan on the home filesystem and prevents descent into mounted filesystems). This mirrors the scope of recommendation 7.2.10. Limitation of this scope: Dot directories that hold sensitive material but reside outside local interactive users' home directories - for example, credential or configuration directories created under /opt, /srv, application working directories, or the home directories of service/system accounts that use nologin / false shells - are not evaluated by this automated check. Administrators should ensure, through separate review or site-specific tooling, that no unexpected dot directories with weak permissions (group- or world-writable, or readable by other where they hold secrets) exist outside the audited scope. If your environment stores per-user credentials outside standard interactive home directories, treat those locations under a separate control. Impact: Making global modifications to users' directories without alerting the user community can result in unexpected outages and unhappy users. Tightening permissions on a dot directory may break applications that relied on group or world access to per-user state (for example, a service account configured to read another user's .config ). Establish a monitoring policy and apply changes in accordance with site policy. This recommendation intentionally scopes its scan to local interactive users' home directories only and does not traverse the entire filesystem. As a result, dot directories that live outside those home directories are out of scope for this automated check and must be reviewed separately.

Name	Audit Name	Plugin	Category
7.2.11 Ensure local interactive user dot directories access is configured	CIS Debian Linux 13 v1.1.0 L1 Workstation	Unix	ACCESS CONTROL, MEDIA PROTECTION
7.2.11 Ensure local interactive user dot directories access is configured	CIS Debian Linux 13 v1.1.0 L1 Server	Unix	ACCESS CONTROL, MEDIA PROTECTION

Detections

Analytics

Item Search