Administrator's Guide

and then deleting and recreating a new file with modified content, but the same
name. In most cases, the application is unaware of the change and may
unintentionally perform malicious acts on behalf of the attacker.
5.1.4 Protecting Files Related to User Accounts
Follow these guidelines to protect files related to user accounts:
• A home directory should not be writable by anyone except for the owner. Otherwise,
any user can add and remove files from the directory.
• The .profile, .kshrc, .login, and .cshrc files for each user should not be
writable by anyone other than the account owner.
• A user's .rhosts file should not be readable or writable by anybody other than
the owner. This precaution prevents users from guessing what other accounts you
have, and prevents anyone from editing your .rhosts file to gain access to those
systems. For more information, see hosts.equiv(4).
• Do not use a .netrc file, because it bypasses login authentication for remote
login and even contains the user's unencrypted password. If used, .netrc must
not be readable or writable by anyone other than its owner. For more information,
see netrc(4).
5.1.5 Locating and Correcting File Corruption Using fsck
The following problems can indicate a corrupt file system:
• A file contains incorrect data (garbage).
• A file has been truncated or is missing data.
• Files disappear or change locations unexpectedly.
• Error messages appear on a user's terminal, the system console, or in the system
log.
• You are not able to change directories or list files.
• The system fails to reboot.
If you or other users cannot readily identify problems with the file system, use the fsck
command to check the file system. The fsck command is the primary tool for finding
and correcting file system inconsistencies. The fsck command examines the file system
listed in /etc/fstab.
The fsck utility is not capable of detecting file corruption. If fsck does not find any
errors, the problem is likely not a corrupted file system. That is, the file system is usable,
even if the underlying data is lost or corrupted. Look for one or more of these other file
problems:
• A user, program, or application deleted, overwrote, moved, or truncated the file or
files.
• The file system associated with a particular directory when the file was created might
not be mounted to that directory.
90 File System Security