lowfilesystemunverified

Ensure no .forward files exist

no-forward-files · RHEL ≥ 8 · 1 impl

Description

The .forward file in user home directories allows users to forward their mail to external addresses. These files should not exist on most systems.

Rationale

Forward files can be used to exfiltrate data or redirect sensitive information to external addresses. On systems where mail forwarding is not required, these files pose an unnecessary risk.

Check → Remediate

Checkcommand

find /home -name '.forward' -type f 2>/dev/null | head -1

expected_exit:: 0

Remediatemanual

note:: Review and remove .forward files from user home directories. Use 'find /home -name .forward -type f' to locate files. Verify each file with the user before removal as they may have legitimate mail forwarding requirements.

Framework references

NIST 800-53

CM-6AC-6

#mail#forward#user-files#security