6.2.13 Ensure users' .netrc Files are not group or world accessible

Information

While the system administrator can establish secure permissions for users'netrc files, the users can easily override these.

Thenetrc file presents a significant security risk since it stores passwords in unencrypted form. Even if FTP is disabled, user accounts may have brought over .netrc files from other systems which could pose a risk to those systems.

If anetrc file is required, and follows local site policy, it should have permissions of 600 or more restrictive.

Solution

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report usernetrc files and determine the action to be taken in accordance with site policy.

The following script will remove .netrc files from interactive users' home directories

#!/bin/bash

awk -F: '($1!~/(halt|sync|shutdown|nfsnobody)/ && $7!~/^(/usr)?/sbin/nologin(/)?$/ && $7!~/(/usr)?/bin/false(/)?$/) { print $6 }' /etc/passwd | while read -r dir; do
if [ -d "$dir" ]; then
file="$dir/.netrc"
[ ! -h "$file" ] && [ -f "$file" ] && rm -f "$file"
fi
done

See Also

https://workbench.cisecurity.org/files/3796