{ "id": "CB-UBU-NET-023", "standard": "ubuntu", "version": "0.1.0", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-023", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-023.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-023.yml", "profiles_effective": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-NET-023", "title": "Restrict access to netplan configuration files", "finding": { "title": "Netplan configuration files can be read or changed by non-root users", "description": "Netplan files hold Wi-Fi passphrases, VPN keys and the addressing of the host; readable or writable copies leak secrets or let anyone change the network at the next apply." }, "status": "active", "profiles": [ "core" ], "risk": { "severity": "medium" }, "assessment": "automated", "tags": [ "netplan", "network", "permissions", "secrets" ], "description": "Ubuntu describes its network configuration in YAML files under `/etc/netplan/`, which netplan\nturns into systemd-networkd or NetworkManager configuration at boot. Cloud images write\n`50-cloud-init.yaml` there, and desktops store the connections made in the GNOME settings as\n`90-NM-*.yaml`. This control requires every `/etc/netplan/*.yaml` file to belong to `root:root`\nwith mode `0600` at most.\n", "rationale": "These files can contain Wi-Fi passphrases (`password` under `wifis`), WireGuard private keys,\n802.1X credentials and static routes. Netplan itself recommends root-only files and warns, on\neach `netplan apply`, about files that other users can read. A file writable by another user\nchanges the addresses, routes or DNS servers of the host at the next boot.\n", "impact": "Users other than root can no longer read the network configuration with `cat`; `netplan get` and\n`ip address` still show the active settings.\n", "notes": "Ubuntu 22.04 and later create `50-cloud-init.yaml` with mode `0600`; 20.04 creates it with\n`0644`, which is why this control fails there on a fresh install. Netplan reads only `*.yaml`\nfiles. Files under `/run/netplan/` and `/lib/netplan/` are generated or shipped by packages and\nare not covered.\n", "setting": { "location": "/etc/netplan/*.yaml", "default_value": "0600 (0644 on 20.04)", "recommended_value": "root:root, 0600" }, "audit": { "manual": "Run `stat -c '%n %U:%G %a' /etc/netplan/*.yaml`. Every file must be `root:root` with mode `600`\nor stricter.\n", "checks": [ { "id": "netplan-files", "engine": "file-perms", "description": "Netplan YAML files.", "spec": { "path": "/etc/netplan/*.yaml", "owner": "root", "group": "root", "mode": "0600" } } ] }, "remediation": { "manual": "Run `chown root:root /etc/netplan/*.yaml` and `chmod 600 /etc/netplan/*.yaml`, then\n`netplan generate` to check that no permission warning remains.\n", "effects": { "restart": "none", "disruption": "none", "lockout_risk": false }, "rollback": "Run `chmod 644 /etc/netplan/.yaml` to restore the previous mode.\n", "scripts": [ { "id": "netplan-files", "from_check": "netplan-files" } ] }, "references": [ { "title": "Netplan documentation - Security", "url": "https://netplan.readthedocs.io/en/stable/security/", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "netplan(5), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man5/netplan.5.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "Ubuntu Server documentation - About Netplan", "url": "https://documentation.ubuntu.com/server/explanation/networking/about-netplan/", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R50", "relation": "partial", "note": "R50 covers every sensitive file; this control covers the netplan files." }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-3", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-5(1)", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1552.001" }, { "framework": "cwe", "id": "CWE-732" } ], "related_controls": [ { "id": "CB-UBU-NET-008", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot", "notes": "50-cloud-init.yaml 0644 on a fresh install, reported and fixed to 0600; not rewritten by cloud-init at reboot." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot", "notes": "Passes on a fresh install (0600); still passes after remediation and reboot." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot", "notes": "Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot", "notes": "Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }