cis-ubuntu2004-v300-7-2-10

name	cis-ubuntu2004-v300-7-2-10
description	Ensure local interactive user dot files access is configured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","users"]
cis_id	7.2.10
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

7.2.10 Ensure local interactive user dot files access is configured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

While the system administrator can establish secure permissions for users' "dot" files, the users can easily override these.

• .forward file specifies an email address to forward the user's mail to.
• .rhost file provides the "remote authentication" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)
• .netrc file contains data for logging into a remote host or passing authentication to an API.
• .bash_history file keeps track of the user's commands.

Rationale

User configuration files with excessive or incorrect access may enable malicious users to steal or modify other users' data or to gain another user's system privileges.

Impact

None

Audit Procedure

Command Line

Run the following script to verify local interactive user dot files:

• Don't include .forward, .rhost, or .netrc files
• Are mode 0644 or more restrictive
• Are owned by the local interactive user
• Are group owned by the user's primary group
• .bash_history is mode 0600 or more restrictive

Note: If a .netrc file is required, and follows local site policy, it should be mode 0600 or more restrictive.

#!/usr/bin/env bash

{
    a_output2=(); a_output3=()
    l_maxsize="1000" # Maximum number of local interactive users before warning (Default 1,000)
    l_valid_shells="^$(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\/,g;p}' | paste -s -d '|' - ))$"
    a_user_and_home=() # Create array with local users and their home directories
    while read -r l_local_user l_local_user_home; do 
        [[ -n  && -n  ]] &&
        a_user_and_home+=()
     <<<  
    [  -gt  ] &&     \
     \
     
    ()
    {
        a_access_out=()
        l_max=
         [ $((  &  )) -gt 0 ]; 
            a_access_out+=()
        
         [[ !  =~ () ]]; 
            a_access_out+=()
        
         [[ !  =~ () ]]; 
            a_access_out+=()
        
    }
     IFS=:  -r l_user l_home; 
        a_dot_file=(); a_netrc=(); a_netrc_warn=(); a_bhout=(); a_hdirout=()
         [ -d  ]; 
            l_group=;l_group=
             IFS=  -r -d $ l_hdfile; 
                  -r l_mode l_owner l_gowner; 
                      
                        .forward | .rhost )
                            a_dot_file+=() ;;
                        .netrc )
                            l_mask=; file_access_chk
                             [  -gt 0 ]; 
                                a_netrc+=()
                            
                                a_netrc_warn+=()
                             ;;
                        .bash_history )
                            l_mask=; file_access_chk
                            [  -gt 0 ] && a_bhout+=() ;;
                        * )
                            l_mask=; file_access_chk
                            [  -gt 0 ] && a_hdirout+=() ;;
                    
                 < <( -Lc  )
             < <(find  -xdev - f -name  -print0)
        
         [[  -gt 0 ||  -gt 0 ||  -gt 0 ||  -gt 0 ]]; 
            a_output2+=(    )
        
        [  -gt 0 ] && a_output3+=( )
     <<< 
     [  -le 0 ]; 
        [  -gt 0 ] &&    
            
    
               
        [  -gt 0 ] &&    
    
}