Skip to content

6.2.17 Ensure local interactive user dot files are not group or world writable

Audit#

Run the following script to verify local interactive user dot files are not group or world writable: 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/bin/env bash

{
 output=""
 perm_mask='0022'
 maxperm="$( printf '%o' $(( 0777 & ~$perm_mask)) )"
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | (while read -r user home; do
 for dfile in $(find "$home" -type f -name '.*'); do
 mode=$( stat -L -c '%#a' "$dfile" )
 [ $(( $mode & $perm_mask )) -gt 0 ] && output="$output\n- User $user file: \"$dfile\" is too permissive: \"$mode\" (should be: \"$maxperm\" or more restrictive)"
 done
 done
 if [ -n "$output" ]; then
 echo -e "\n- Failed:$output"
 else
 echo -e "\n- Passed:\n- All user home dot files are mode: \"$maxperm\" or more restrictive"
 fi
 )
}

Remediation#

Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy.

The following script will remove excessive permissions on dot files within interactive users' home directories. 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
#!/usr/bin/env bash

{
 perm_mask='0022'
 valid_shells="^($( sed -rn '/^\//{s,/,\\\\/,g;p}' /etc/shells | paste -s -d '|' - ))$"
 awk -v pat="$valid_shells" -F: '$(NF) ~ pat { print $1 " " $(NF-1) }' /etc/passwd | while read -r user home; do
 find "$home" -type f -name '.*' | while read -r dfile; do
 mode=$( stat -L -c '%#a' "$dfile" )
 if [ $(( $mode & $perm_mask )) -gt 0 ]; then
 echo -e "\n- Modifying User \"$user\" file: \"$dfile\"\nremoving group and other write permissions"
 chmod go-w "$dfile"
 fi
 done
 done
}