Skip to content

6.2.15 Ensure no local interactive user has .forward files

Audit#

Run the following script and verify no lines are returned: 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
#!/usr/bin/env bash

{
 output=""
 fname=".forward"
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | (while read -r user home; do
 [ -f "$home/$fname" ] && output="$output\n - User \"$user\" file: \"$home/$fname\" exists"
 done
 if [ -z "$output" ]; then
 echo -e "\n-PASSED: - No local interactive users have \"$fname\" files in their home directory\n"
 else
 echo -e "\n- FAILED:\n$output\n"
 fi
 )
}

Remediation#

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user .forward files and determine the action to be taken in accordance with site policy.

The following script will remove .forward files from interactive users' home directories 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
#!/usr/bin/env bash

{
 output=""
 fname=".forward"
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | (while read -r user home; do
 if [ -f "$home/$fname" ]; then
 echo -e "$output\n- User \"$user\" file: \"$home/$fname\" exists\n - removing file: \"$home/$fname\"\n"
 rm -r "$home/$fname"
 fi
 done
 )
}