Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The .netrc file can contain username and password credentials for various sites, to allow simpler invocation of tools. For example curl with the -n option will read credentials from the file, for the given target site. Or FTP does similar.

Also custom written command-line tools and scripts can be designed to read credentials from the same file.

Assuming the file itself has 0400 permissions, Is this generally considered to be safe? different people seem to have different opinions.

share|improve this question
    
Also custom written command-line tools and scripts can be designed to read credentials from the same file. Kinda answered your own question, there. s/curl/evil_bot/. – Parthian Shot Jul 22 '15 at 0:35

Storing credentials in clear-text on your computer is a risky business as any application that runs on your computer has access to these credentials. The credentials are also exposed in backups, zips, etc...

.netrc files are a prime target for attackers looking to branch out to other computers.

share|improve this answer

There is much debate on this. While Neil's answer is correct, storing any credentials on your computer is inherently risky. Even if you encrypt them and store them in a unique location, software you run needs access to the encryption key(s). If you enter the encryption keys every time (or a password to unlock them or similar), it may be just as easy to enter the credentials.

This problem is not unique to passwords. Un*x tends to rely heavily on file permissions (access control) but they cannot differentiate one process running as user from another. SSH private keys stored in ~/.ssh are also a risk, for example.

The main benefit to a standard location for credentials like .netrc is keeping them separate from scripts or other programs that use them. For example, if you write a shell script that automates an FTP session, embedding the user name and password in the script instead of a .netrc file may lead to the credentials inadvertently being shared as the script is stored in source control or copied to other systems.

Using a central location like .netrc also allows individuals to have their own credentials for accessing systems. Shared accounts are frowned upon because it activities cannot be attributed to an individual. Otherwise, individuals need their own copies of scripts.

The second benefit is only having a single place to update changed credentials. If multiple scripts or programs use the same but old credentials, you can lock out accounts. Changing the .netrc file can update multiple scripts or programs at the same time.

That said, encrypting passwords at rest prevents inadvertent access to passwords, such as through backups, shoulder surfing or similar. If you must store credentials on a system, consider something like an encrypted store over the plaintext .netrc file if one is available. For example, git now supports encrypted .netrc files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.