Check: GEN001470
Title
The /etc/passwd file must not contain password hashes. (Cat II impact)
Discussion
If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.
Check Content
Verify no password hashes are present in /etc/passwd. # cat /etc/passwd If any password hashes are returned, this is a finding.
Fix Text
Migrate /etc/passwd password hashes to /etc/shadow. # pwconv
Additional Identifiers
Rule ID:
Vulnerability ID: V-22347
Group Title:
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-000201 |
The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| IA-5 (6) |
Protection Of Authenticators |