cyberstrikeus CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - 6.1.7
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The /etc/shadow- file is used to store backup information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information.
Rationale
It is critical to ensure that the /etc/shadow- file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.
Audit Procedure
Command Line
Run the following command and verify Uid is 0/root, Gid is 0/root or <gid>/shadow, and Access is 640 or more restrictive:
stat /etc/shadow-
Expected Result
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)
Remediation
Command Line
Run one of the following commands to set ownership of /etc/shadow- to root and group to either root or shadow:
chown root:root /etc/shadow-
chown root:shadow /etc/shadow-
Run the following command to remove excess permissions from /etc/shadow-:
chmod u-x,g-wx,o-rwx /etc/shadow-
Default Value
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)
References
- CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
CIS Controls
| Controls Version | Control |
|---|---|
| v7 | 16.4 Encrypt or Hash all Authentication CredentialsEncrypt or hash with a salt all authentication credentials when stored. |
Assessment Status
Automated