cis-ubuntu2004-v300-7-2-1

name	cis-ubuntu2004-v300-7-2-1
description	Ensure accounts in /etc/passwd use shadowed passwords
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","users"]
cis_id	7.2.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

7.2.1 Ensure accounts in /etc/passwd use shadowed passwords (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Local accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, /etc/shadow, encrypted by a salted one-way hash. Accounts with a shadowed password have an x in the second field in /etc/passwd.

Rationale

The /etc/passwd file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the /etc/passwd file must remain world readable. In spite of encoding the password with a randomly-generated one-way hash function, an attacker could still break the system if they got access to the /etc/passwd file. This can be mitigated by using shadowed passwords, thus moving the passwords in the /etc/passwd file to /etc/shadow. The /etc/shadow file is set so only root will be able to read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords with which to perform a dictionary attack.

Note:

• All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.
• A user account with an empty second field in /etc/passwd allows the account to be logged into by providing only the username.

Impact

None

Audit Procedure

Command Line

Run the following command and verify that no output is returned:

# awk -F: '($2 != "x" ) { print "User: \"" $1 "\" is not set to shadowed passwords "}' /etc/passwd

Expected Result

No output should be returned.

Remediation

Command Line

Run the following command to set accounts to use shadowed passwords and migrate passwords in /etc/passwd to /etc/shadow:

# pwconv

Investigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off.

Default Value

N/A

References

1. NIST SP 800-53 Rev. 5: IA-5
2. PWCONV(8)

Additional Information