Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy. The following script will: - remove excessive permissions on dot files within interactive users' home directories - change ownership of dot files within interactive users' home directories to the user - change group ownership of dot files within interactive users' home directories to the user's primary group - listforward andrhost files to be investigated and manually deleted #!/usr/bin/env bash { l_valid_shells="^($( awk -F/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^//{s,/,\\/,g;p}' | paste -s -d '|' - ))$" unset a_uarr && a_uarr=() # Clear and initialize array while read -r l_epu l_eph; do # Populate array with users and user home location [[ -n "$l_epu" && -n "$l_eph" ]] && a_uarr+=("$l_epu $l_eph") done <<< "$(awk -v pat="$l_valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd)" l_asize="${#a_uarr[@]}" # Here if we want to look at number of users before proceeding l_maxsize="1000" # Maximum number of local interactive users before warning (Default 1,000) [ "$l_asize " -gt "$l_maxsize" ] && echo -e " ** INFO ** - \"$l_asize\" Local interactive users found on the system - This may be a long running check " file_access_fix() { l_facout2="" l_max="$( printf '%o' $(( 0777 & ~$l_mask)) )" if [ $(( $l_mode & $l_mask )) -gt 0 ]; then echo -e " - File: \"$l_hdfile\" is mode: \"$l_mode\" and should be mode: \"$l_max\" or more restrictive - Changing to mode \"$l_max\"" chmod "$l_chp" "$l_hdfile" fi if [[ ! "$l_owner" =~ ($l_user) ]]; then echo -e " - File: \"$l_hdfile\" owned by: \"$l_owner\" and should be owned by \"${l_user//|/ or }\" - Changing ownership to \"$l_user\"" chown "$l_user" "$l_hdfile" fi if [[ ! "$l_gowner" =~ ($l_group) ]]; then echo -e " - File: \"$l_hdfile\" group owned by: \"$l_gowner\" and should be group owned by \"${l_group//|/ or }\" - Changing group ownership to \"$l_group\"" chgrp "$l_group" "$l_hdfile" fi } while read -r l_user l_home; do if [ -d "$l_home" ]; then echo -e " - Checking user: \"$l_user\" home directory: \"$l_home\"" l_group="$(id -gn "$l_user" | xargs)" l_group="${l_group// /|}" while IFS= read -r -d $'0' l_hdfile; do while read -r l_mode l_owner l_gowner; do case "$(basename "$l_hdfile")" in .forward | .rhost ) echo -e " - File: \"$l_hdfile\" exists - Please investigate and manually delete \"$l_hdfile\"" ;; .netrc ) l_mask='0177' l_chp="u-x,go-rwx" file_access_fix ;; .bash_history ) l_mask='0177' l_chp="u-x,go-rwx" file_access_fix ;; * ) l_mask='0133' l_chp="u-x,go-wx" file_access_fix ;; esac done <<< "$(stat -Lc '%#a %U %G' "$l_hdfile")" done < <(find "$l_home" -xdev -type f -name '.*' -print0) fi done <<< "$(printf '%s ' "${a_uarr[@]}")" unset a_uarr # Remove array }

Name	Audit Name	Plugin	Category
6.2.11 Ensure local interactive user dot files access is configured	CIS AlmaLinux OS 8 Workstation L1 v3.0.0	Unix	ACCESS CONTROL, MEDIA PROTECTION
6.2.11 Ensure local interactive user dot files access is configured	CIS AlmaLinux OS 8 Server L1 v3.0.0	Unix	ACCESS CONTROL, MEDIA PROTECTION

Detections

Analytics

Item Search