---
title: "HOST-USR-010 Home Directories Accessible to Other Users"
canonical: https://openvapt.com/checks/HOST-USR-010.html
html: https://openvapt.com/checks/HOST-USR-010.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-USR-010 Home Directories Accessible to Other Users

Checks that the home directory of each interactive account denies read, write and execute to others.

- Domain: Server
- Severity: Low
- Control category: Access Control
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-732, CWE-276
- NIST SP 800-53 Rev. 5: AC-3, AC-6
- Benchmark topic: Home directory permissions (topic only, no benchmark text)

## Why It Matters

Home directories hold shell history, SSH keys, application configuration and downloads. With others allowed in, any account on the machine can read another user's history and keys or, with write access, plant a .bashrc that runs when that user logs in.

## How It Detects

Reads interactive accounts from /etc/passwd (UID at or above UID_MIN, a real shell), stats each home directory (metadata only) and fails when others have any permission bit. Missing home directories are noted but do not fail.

## How to Fix

chmod 750 /home/<user>  for each listed account (700 if group access is not needed), and set HOME_MODE 0750 in /etc/login.defs or DIR_MODE=0750 in /etc/adduser.conf so new accounts start that way.

## How to Verify

```
stat -c '%a %n' /home/*  shows 750 or 700.
```

## Learn the Theory

- [P7 Identity, Passwords and Privilege](https://openvapt.com/academy/p7.md)
- [P15 Access Control: Accounts, Sudo and Logins](https://openvapt.com/academy/p15.md)
- [P20 Secrets, Cron and Account Hygiene](https://openvapt.com/academy/p20.md)

## References

- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)
- [login.defs(5), Linux man-pages](https://man7.org/linux/man-pages/man5/login.defs.5.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go

Run it: `openvapt scan --only HOST-USR-010`. Read it offline: `openvapt explain HOST-USR-010`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-USR-010.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.