Check: OL6-00-000538
Oracle Linux 6 STIG:
OL6-00-000538
(in versions v2 r7 through v2 r6)
Title
The Oracle Linux operating system must not have accounts configured with blank or null passwords. (Cat I impact)
Discussion
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Check Content
Check the "/etc/shadow" file for blank passwords with the following command: $ sudo awk -F: '!$2 {print $1}' /etc/shadow If the command returns any results, this is a finding.
Fix Text
Configure all accounts on the system to have a password or lock the account with the following commands: Perform a password reset: $ sudo passwd [username] Lock an account: $ sudo passwd -l [username]
Additional Identifiers
Rule ID: SV-251695r809132_rule
Vulnerability ID: V-251695
Group Title: SRG-OS-000480
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |