Check: GEN001470
SUSE Linux Enterprise Server v11 for System z STIG:
GEN001470
(in versions v1 r12 through v1 r9)
Title
The /etc/passwd file must not contain password hashes. (Cat II impact)
Discussion
If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.
Check Content
Verify no password hashes are present in /etc/passwd. # cut -d : -f 2 /etc/passwd | egrep -v '^(x|\*)$' If any password hashes are returned, this is a finding.
Fix Text
Migrate /etc/passwd password hashes to /etc/shadow. # pwconv
Additional Identifiers
Rule ID: SV-45016r1_rule
Vulnerability ID: V-22347
Group Title: GEN001470
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-000201 |
The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| IA-5 (6) |
Protection Of Authenticators |