STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

All .rhosts, .shosts, .netrc, or hosts.equiv files must be accessible by only root or the owner.

DISA Rule

SV-227690r603266_rule

Vulnerability Number

V-227690

Group Title

SRG-OS-000480

Rule Version

GEN002060

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Ensure the permission for these files is set at 600 or less and the owner is the owner of the home directory that it is in. These files, outside of home directories (other than hosts.equiv in /etc and shosts.equiv in /etc/ssh; both are owned by root), have no meaning.

Check Contents

# for i in `cut -d: -f6 /etc/passwd | awk '$1 == "" {$1 = "/"} {print $1}'`; do ls -l $i/.rhosts $i/.shosts $i/.netrc; done
# ls -l /etc/hosts.equiv
# ls -l /etc/ssh/shosts.equiv

If the .netrc, .rhosts, .shosts, hosts.equiv, or shosts.equiv files have permissions greater than 600, then this is a finding. (If a password entry has no home directory assigned, the root directory (/) is used as a default.)

Vulnerability Number

V-227690

Documentable

False

Rule Version

GEN002060

Severity Override Guidance

# for i in `cut -d: -f6 /etc/passwd | awk '$1 == "" {$1 = "/"} {print $1}'`; do ls -l $i/.rhosts $i/.shosts $i/.netrc; done
# ls -l /etc/hosts.equiv
# ls -l /etc/ssh/shosts.equiv

If the .netrc, .rhosts, .shosts, hosts.equiv, or shosts.equiv files have permissions greater than 600, then this is a finding. (If a password entry has no home directory assigned, the root directory (/) is used as a default.)

Check Content Reference

M

Target Key

4061

Comments