mediumaccess-controlverified ✓

Verify local interactive user home directories exist

home-dirs-exist · RHEL ≥ 8 · 1 impl

Description

All RHEL 8 local interactive user home directories defined in the /etc/passwd file must exist on the filesystem. User accounts with non-existent home directories may be exploited.

Rationale

If a user account home directory does not exist, the user could log in and their session would be placed in the root directory. This could allow users to access files they should not see. Additionally, missing home directories indicate inconsistent user account management.

Check → Remediate

Checkcommand

bad=$(awk -F: '$3 >= 1000 && $3 < 65534 && $7 != "/sbin/nologin" && $7 != "/bin/false" && $7 != "" {print $6}' \
  /etc/passwd 2>/dev/null |
  while read hd; do
    [ -d "$hd" ] || echo "MISSING: $hd"
  done)
[ -z "$bad" ]

expected_exit:: 0

Remediatemanual

note:: For each missing home directory, create it with appropriate ownership: mkdir -p <home-directory> chown <user>:<group> <home-directory> chmod 0750 <home-directory>

Framework references

STIG

V-281177 / RHEL-10-600180V-281178 / RHEL-10-600190V-258052 / RHEL-09-411065V-230323

NIST 800-53

CM-6AC-6

Live verification

rhel8:check

#home-directory#users#filesystem#account-management