[PATCH] Added prose regarding netrc files. trac ticket #88.
Willy Santos
wsantos at redhat.com
Sat Aug 11 00:43:43 UTC 2012
---
.../accounts/restrictions/password_storage.xml | 24 +++++++++++++++++++-
1 files changed, 23 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index 8f39126..29572f2 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -40,7 +40,6 @@ environments.
<ref nist="AC-3, CM-6, IA-5" />
</Rule>
-
<Rule id="no_hashes_outside_shadow">
<title>Verify All Account Password Hashes are Shadowed</title>
<description>To ensure that no password hashes are stored in
@@ -56,5 +55,28 @@ which is readable by all users.
<oval id="accounts_password_all_shadowed" />
<ref nist="IA-5" disa="196" />
</Rule>
+
+<Rule id="no_netrc_files">
+<title>Verify No netrc Files Exist</title>
+<description>The <tt>.netrc</tt> files contain login information
+used to auto-login into FTP servers and reside in the user's home
+directory. These files may contain unencrypted passwords to
+remote FTP servers making them susceptible to access by unauthorized
+users and should not be used.
+<br /><br />
+To check the system for the existence of any <tt>.netrc</tt> files,
+run the following command:
+<pre># find / -name .netrc</pre>
+</description>
+<rationale>
+Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
+files. DoD policy requires passwords be encrypted in storage and not used
+in access scripts.
+</rationale>
+<ident cce="TODO" />
+<oval id="TODO" />
+<ref nist="IA-5" disa="196" />
+</Rule>
+
</Group>
--
1.7.7.6
More information about the scap-security-guide
mailing list