Restrict access to APT repository credentials

Description

/etc/apt/auth.conf and the .conf files of /etc/apt/auth.conf.d/ hold logins and passwords for private repositories and proxies, in a netrc-like format. APT reads them as root before it drops privileges, so they can be root:root mode 0600. The directory itself should be root:root mode 0755 or stricter.

Rationale

These credentials often give access to commercial or internal repositories, sometimes shared by a whole fleet. A readable file leaks them to every local user; a writable directory lets a user add or change them.

Impact

None known. The directory is empty on a default installation; the file checks apply only when files exist.

Setting

Audit

1. stat -c '%U:%G %a' /etc/apt/auth.conf.d shows root:root and 755 or stricter.
2. stat -c '%U:%G %a %n' /etc/apt/auth.conf /etc/apt/auth.conf.d/* shows root:root and 600 or stricter for every existing file.

Automated: every check must pass. Scanners report each check by its id.

auth-conf-d

The /etc/apt/auth.conf.d directory.

path: /etc/apt/auth.conf.d
owner: root
group: root
mode: '0755'

auth-conf-d-files

Files in /etc/apt/auth.conf.d (not applicable when empty).

path: /etc/apt/auth.conf.d/*
owner: root
group: root
mode: '0600'

auth-conf

The legacy /etc/apt/auth.conf file (not applicable when absent).

path: /etc/apt/auth.conf
owner: root
group: root
mode: '0600'

Remediation

Run chown root:root /etc/apt/auth.conf.d, chmod 755 /etc/apt/auth.conf.d, then for each credential file chown root:root <file> and chmod 600 <file>. Change the passwords if the files were readable by other users.

Rollback

Restore the previous owner and mode with chown and chmod.

auth-conf-d

Generated from check auth-conf-d: the engine writes the fix for every output, it sets the expected value and the check runs again after.

auth-conf-d-files

Generated from check auth-conf-d-files: the engine writes the fix for every output, it sets the expected value and the check runs again after.

auth-conf

Generated from check auth-conf: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apt_auth.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-PKG-004 Restrict write access to APT keys and repository lists

People and lifecycle