UCF STIG Viewer Logo

There must be no .netrc files on the system.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38619 RHEL-06-000347 SV-50420r2_rule Medium
Description
Unencrypted passwords for remote FTP servers may be stored in ".netrc" files. DoD policy requires passwords be encrypted in storage and not used in access scripts.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-05-26

Details

Check Text ( C-46179r3_chk )
To check the system for the existence of any ".netrc" files, run the following command:

$ sudo find /root /home -xdev -name .netrc

If any .netrc files exist, this is a finding.
Fix Text (F-43569r2_fix)
The ".netrc" files contain logon information used to auto-logon into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any ".netrc" files should be removed.