Title

The /etc/gshadow file must not contain any group password hashes. (Cat II impact)

Discussion

Group passwords are typically shared and should not be used.

Check Content

Check the /etc/gshadow file for password hashes. # cut -d : -f 2 /etc/gshadow | egrep -v '^(x|!|)$' If any password hashes are returned, this is a finding.

Fix Text

Edit /etc/gshadow and change the password field to an exclamation point (!) to lock the group password.

Additional Identifiers

Rule ID: SV-26448r1_rule

Vulnerability ID: V-22349

Group Title: GEN000000-LNX001476

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.