Skip to content

6.2.14 Ensure no local interactive user has .netrc files

Audit#

Run the following script. This script will return:

  • FAILED: for any .netrc file with permissions less restrictive than 600
  • WARNING: for any .netrc files that exist in interactive users' home directories. 
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
    #!/usr/bin/env bash

{
 output="" output2=""
 perm_mask='0177'
 maxperm="$( printf '%o' $(( 0777 & ~$perm_mask)) )"
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | (while read -r user home; do
 if [ -f "$home/.netrc" ]; then
 mode="$( stat -L -c '%#a' "$home/.netrc" )"
 if [ $(( $mode & $perm_mask )) -gt 0 ]; then
 output="$output\n - User \"$user\" file: \"$home/.netrc\" is too permissive: \"$mode\" (should be: \"$maxperm\" or more restrictive)"
 else
 output2="$output2\n - User \"$user\" file: \"$home/.netrc\" exists and has file mode: \"$mode\" (should be: \"$maxperm\" or more restrictive)"
 fi
 fi
 done
 if [ -z "$output" ]; then
 if [ -z "$output2" ]; then
 echo -e "\n-PASSED: - No local interactive users have \".netrc\" files in their home directory\n"
 else
 echo -e "\n- WARNING:\n$output2\n"
 fi
 else
 echo -e "\n- FAILED:\n$output\n"
 [ -n "$output2" ] && echo -e "\n- WARNING:\n$output2\n"
 fi
 )
}

Verify:

  • Any lines under FAILED: - File should be removed unless deemed necessary, in accordance with local site policy, and permissions are updated to be 600 or more restrictive
  • Any lines under WARNING: - File should be removed unless deemed necessary, and in accordance with local site policy

Remediation#

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user .netrc file permissions and determine the action to be taken in accordance with local site policy.

The following script will remove .netrc files from interactive users' home directories 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
#!/usr/bin/env bash

{
 perm_mask='0177'
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | while read -r user home; do
 if [ -f "$home/.netrc" ]; then
 echo -e "\n- User \"$user\" file: \"$home/.netrc\" exists\n - removing file: \"$home/.netrc\"\n"
 rm -f "$home/.netrc"
 fi
 done
}