Skip to content

6.2.16 Ensue no local interactive user has .rhosts files

Audit#

Run the following script to verify no local interactive user has .rhosts files: 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
#!/usr/bin/env bash

{
 output=""
 fname=".rhosts"
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | (while read -r user home; do
 [ -f "$home/$fname" ] && output="$output\n - User \"$user\" file: \"$home/$fname\" exists"
 done
 if [ -z "$output" ]; then
 echo -e "\n-PASSED: - No local interactive users have \"$fname\" files in their home directory\n"
 else
 echo -e "\n- FAILED:\n$output\n"
 fi
 )
}

Remediation#

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user .rhosts files and determine the action to be taken in accordance with site policy.

The following script will remove .rhosts files from interactive users' home directories 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
#!/usr/bin/env bash

{
 perm_mask='0177'
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | while read -r user home; do
 if [ -f "$home/.rhosts" ]; then
 echo -e "\n- User \"$user\" file: \"$home/.rhosts\" exists\n - removing file: \"$home/.rhosts\"\n"
 rm -f "$home/.rhosts"
 fi
 done
}