Servers – Verify Security Of Dot Files

Support > Fixing Checks > Server

06 March, 2026

This check ensures that users' dot files are not group-writable or world-writable.

Dot files are hidden configuration files located in user home directories. If these files are writable by group or other users, it may allow unauthorized users to modify configuration settings or gain access to another user's data.

Check Details

Resource: Server
Check: Verify Security of Dot Files
Risk: Group or world-writable user configuration files may enable malicious users to steal or modify other users' data or gain another user's system privileges.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.

Run the following script to identify users' dot files that are group-writable or world-writable.

#!/bin/bash

grep -E -v '^(halt|sync|shutdown)' /etc/passwd | \
awk -F: '($7 != "'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | \
while read user dir; do

    if [ ! -d "$dir" ]; then
        echo "The home directory ($dir) of user $user does not exist."

    else
        for file in $dir/.[A-Za-z0-9]*; do

            if [ ! -h "$file" -a -f "$file" ]; then

                fileperm=$(ls -ld "$file" | cut -f1 -d" ")

                if [ "$(echo $fileperm | cut -c6)" != "-" ]; then
                    echo "Group Write permission set on file $file"
                fi

                if [ "$(echo $fileperm | cut -c9)" != "-" ]; then
                    echo "Other Write permission set on file $file"
                fi

            fi

        done
    fi

done

For any dot files identified as group-writable or world-writable, remove the write permissions according to your organization's policy.
```
chmod go-w <dotfile>
```

Note: On some distributions the /sbin/nologin should be replaced with /usr/sbin/nologin.

Other Articles

Servers – Verify Security Of Dot Files

Check Details

Remediation Steps