Detections
Analytics

6.2.1 Ensure accounts in /etc/master.passwd use shadowed passwords

Information

Local accounts can use shadowed passwords. These passwords are saved in a shadow password file, /etc/master.passwd, encrypted by a salted one-way hash. Accounts with a shadowed password have an x in the second field in /etc/passwd.

The /etc/passwd file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the /etc/passwd file must remain world-readable. Despite encoding the password with a randomly generated one-way hash function, an attacker could still break the system if they got access to the /etc/passwd file. This can be mitigated by using shadowed passwords, thus moving the passwords in the /etc/passwd file to /etc/master.passwd . The /etc/master.passwd file is set, so only the root can read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords to perform a dictionary attack.

Note:

 - All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.
 - A user account with an empty second field in /etc/passwd allows the account to be logged into by providing only the username.

Solution

Investigate to determine if the account is logged in, what it is being used for, and whether it needs to be forced off.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Unix

Control ID: 6288554dea2abe63ca223bac127b163d7b1dd6cdbcc6008eac69bacfa6c39256