documentation_complete: true


title: "Ensure users' .netrc Files are not group or world accessible"

description: |-
    While the system administrator can establish secure permissions for users' .netrc files, the
    users can easily override these.

    This rule ensures every .netrc file or directory under the home directory related
    to an interactive user is not group or world accessible

rationale: |-
    .netrc files may contain unencrypted passwords that may be used to attack other systems.
    Note: While the complete removal of .netrc files is recommended, if any are required on the
          system, secure permissions must be applied.

severity: medium

identifiers:
    cce@rhel8: CCE-87369-5
    cce@sle12: CCE-92446-4
    cce@sle15: CCE-92697-2
    cce@slmicro5: CCE-94027-0

references:
    cis@sle12: 6.2.11
    cis@sle15: 6.2.11

ocil_clause: 'the group and world permissions are incorrect'

ocil: |-
    To verify .netrc file in interactive user home directory is
    not group or world accessible", run the following command:
    <pre>$ sudo ls -lLR /home/<i>USER</i>/.netrc</pre>
