Description
Ubuntu describes its network configuration in YAML files under /etc/netplan/, which netplan
turns into systemd-networkd or NetworkManager configuration at boot. Cloud images write
50-cloud-init.yaml there, and desktops store the connections made in the GNOME settings as
90-NM-*.yaml. This control requires every /etc/netplan/*.yaml file to belong to root:root
with mode 0600 at most.
Ubuntu 22.04 and later create 50-cloud-init.yaml with mode 0600; 20.04 creates it with
0644, which is why this control fails there on a fresh install. Netplan reads only *.yaml
files. Files under /run/netplan/ and /lib/netplan/ are generated or shipped by packages and
are not covered.
Rationale
These files can contain Wi-Fi passphrases (password under wifis), WireGuard private keys,
802.1X credentials and static routes. Netplan itself recommends root-only files and warns, on
each netplan apply, about files that other users can read. A file writable by another user
changes the addresses, routes or DNS servers of the host at the next boot.
Impact
Users other than root can no longer read the network configuration with cat; netplan get and
ip address still show the active settings.
Setting
| Location | /etc/netplan/*.yaml |
| Default | 0600 (0644 on 20.04) |
| Recommended | root:root, 0600 |
Audit
Run stat -c '%n %U:%G %a' /etc/netplan/*.yaml. Every file must be root:root with mode 600
or stricter.
Automated: every check must pass. Scanners report each check by its id.
netplan-files
Netplan YAML files.
path: /etc/netplan/*.yaml
owner: root
group: root
mode: '0600'
Remediation
Run chown root:root /etc/netplan/*.yaml and chmod 600 /etc/netplan/*.yaml, then
netplan generate to check that no permission warning remains.
| Restart | none |
| Disruption | none |
Rollback
Run chmod 644 /etc/netplan/<file>.yaml to restore the previous mode.
netplan-files
Generated from check netplan-files: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Netplan documentation - Security Canonical, vendor-doc, accessed 2026-10-19
- netplan(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
- Ubuntu Server documentation - About Netplan Canonical, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R50 | partial | R50 covers every sensitive file; this control covers the netplan files. |
| NIST SP 800-53 Rev. 55.1.1 | AC-3 | related | |
| NIST SP 800-53 Rev. 55.1.1 | IA-5(1) | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
Related controls
- related
CB-UBU-NET-008Restrict access to firewall and IPsec configuration files
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot. 50-cloud-init.yaml 0644 on a fresh install, reported and fixed to 0600; not rewritten by cloud-init at reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot. Passes on a fresh install (0600); still passes after remediation and reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot. Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot. Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
