Servers – Ensure No Users Have .forward Files

Support > Fixing Checks > Server

06 March, 2026

This check ensures that no users have .forward files in their home directories.

The .forward file specifies an email address to forward the user's mail to. The presence of this file can pose a security risk as sensitive information may be inadvertently transferred outside the organization or used to execute unintended commands.

Check Details

Resource: Server
Check: Ensure No Users Have .forward Files
Risk: The presence of .forward files may result in sensitive information being forwarded outside the organization or may allow execution of unintended commands.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.

Run the following script to identify .forward files in user home directories.

grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | \
awk -F: '($7 != "'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | \
while read user dir; do
    if [ ! -d "$dir" ]; then
        echo "The home directory ($dir) of user $user does not exist."
    else
        if [ ! -h "$dir/.forward" -a -f "$dir/.forward" ]; then
            echo ".forward file $dir/.forward exists"
        fi
    fi
done

Establish a monitoring policy to report user .forward files and determine the appropriate action to be taken according to site policy.

Note: On some distributions, /sbin/nologin may be replaced with /usr/sbin/nologin.

Other Articles

Servers – Ensure No Users Have .forward Files

Check Details

Remediation Steps