Other Articles

Servers – Restrict Access to .netrc Files

Support > Fixing Checks > Server

06 March, 2026

This check ensures that users' .netrc files are not accessible by group or other users.

The .netrc file may store authentication credentials used for automatic login to remote systems. If these files have improper permissions, sensitive credentials may be exposed to other users on the system.

Check Details

  • Resource: Server
  • Check: Restrict Access to .netrc Files
  • Risk: If .netrc files are readable or writable by group or other users, unencrypted credentials may be exposed, potentially allowing unauthorized access to other systems.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Run the following script to identify .netrc files that have insecure permissions.

    grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | \
awk -F: '($7 != "'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | \
while read user dir; do
    if [ ! -d "$dir" ]; then
echo "The home directory ($dir) of user $user does not exist."
    else
        for file in $dir/.netrc; do
          if [ ! -h "$file" -a -f "$file" ]; then
                fileperm=$(ls -ld $file | cut -f1 -d" ")
if [ $(echo $fileperm | cut -c5) != "-" ]; then
echo "Group Read set on $file"
fi
if [ $(echo $fileperm | cut -c6) != "-" ]; then
echo "Group Write set on $file"
fi
if [ $(echo $fileperm | cut -c7) != "-" ]; then
echo "Group Execute set on $file"
fi
if [ $(echo $fileperm | cut -c8) != "-" ]; then
echo "Other Read set on $file"
fi
if [ $(echo $fileperm | cut -c9) != "-" ]; then
echo "Other Write set on $file"
fi
if [ $(echo $fileperm | cut -c10) != "-" ]; then
echo "Other Execute set on $file"
fi
fi
done
fi
done
  3. If any .netrc files are found with insecure permissions, restrict access so that only the file owner can read or write the file.

  4. Apply secure permissions using the following command:

    chmod 600 /home/username/.netrc
  5. Establish a monitoring policy to regularly review user .netrc file permissions and take appropriate action according to site security policies.

Note: On some distributions, /sbin/nologin may be replaced with /usr/sbin/nologin.