用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-7-2-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu2004-v300-7-2-1 |
| description | Ensure accounts in /etc/passwd use shadowed passwords |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","users"] |
| cis_id | 7.2.1 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Local accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, /etc/shadow, encrypted by a salted one-way hash. Accounts with a shadowed password have an x in the second field in /etc/passwd.
The /etc/passwd file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the /etc/passwd file must remain world readable. In spite of encoding the password with a randomly-generated one-way hash function, an attacker could still break the system if they got access to the /etc/passwd file. This can be mitigated by using shadowed passwords, thus moving the passwords in the /etc/passwd file to /etc/shadow. The /etc/shadow file is set so only root will be able to read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords with which to perform a dictionary attack.
Note:
/etc/passwd allows the account to be logged into by providing only the username.None
Run the following command and verify that no output is returned:
# awk -F: '($2 != "x" ) { print "User: \"" $1 "\" is not set to shadowed passwords "}' /etc/passwd
No output should be returned.
Run the following command to set accounts to use shadowed passwords and migrate passwords in /etc/passwd to /etc/shadow:
# pwconv
Investigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off.
N/A
The pwconv command creates shadow from passwd and an optionally existing shadow.
pwunconv command creates passwd from passwd and shadow and then removes shadow.grpconv command creates gshadow from group and an optionally existing gshadow.grpunconv command creates group from group and gshadow and then removes gshadow.These four programs all operate on the normal and shadow password and group files: /etc/passwd, /etc/group, /etc/shadow, and /etc/gshadow.
Each program acquires the necessary locks before conversion. pwconv and grpconv are similar. First, entries in the shadowed file which don't exist in the main file are removed. Then, shadowed entries which don't have 'x' as the password in the main file are updated. Any missing shadowed entries are added. Finally, passwords in the main file are replaced with 'x'. These programs can be used for initial conversion as well to update the shadowed file if the main file is edited by hand.
pwconv will use the values of PASS_MIN_DAYS, PASS_MAX_DAYS, and PASS_WARN_AGE from /etc/login.defs when adding new entries to /etc/shadow.
pwunconv and grpunconv are similar. Passwords in the main file are updated from the shadowed file. Entries which exist in the main file but not in the shadowed file are left alone. Finally, the shadowed file is removed. Some password aging information is lost by pwunconv. It will convert what it can.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | X | X | |
| v7 | 16.4 Encrypt or Hash all Authentication Credentials | X | X |
MITRE ATT&CK Mappings:
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1003, T1003.008 | TA0003 | M1027 |