Detections
Analytics
7.2.10 Ensure no passwords are stored in /etc/group
Information
The /etc/group file defines system groups and their memberships. Modern systems store encrypted group passwords in /etc/gshadow . The /etc/group file should contain an x placeholder in the password field, indicating that any gorup password is stored securely in /etc/gshadow.Note: Group passwords are an inherent security problem since more than one person is permitted to know the password. However, groups are a useful tool for permitting co-operation between different users.
The /etc/group file is world-readable to allow group membership resolution. If password hashes are stored in this file instead of /etc/gshadow, they become accessible to all local users, increasing the risk of credential exposure and privilege escalation. Ensuring group passwords are stored only in /etc/gshadow protects sensitive authentication data.
Solution
- Review the groups that contain passwords and determine if group passwords are needed.- Remove the group password using the following command:
# gpasswd --remove-password <group>
- - IF - /etc/gshadow does not exist create it using the following command:
# touch /etc/gshadow
- - IF - group passwords are needed recreate them per site policy using the gpasswd command
Impact:
This change may affect environments that relay on legacy group password functionality. Administrators should verify that no operational processes depend on group passwords.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4
Plugin: Unix
Control ID: 2fd30656e6d939c17360ce3db3b38a7a33531e15d45b6ae85f0a2b85a3adfaf9