Ensure password fields are not empty

How it is checked

Audit method: Shell command

[ -r /etc/shadow ] || exit 1
u=$(awk -F: '($2 == "") {print $1}' /etc/shadow)
[ -z "$u" ] && echo compliant || echo "accounts without password: $(printf '%s ' $u)"

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

If any accounts in the /etc/shadow file do not have a password, run the following command to lock the account until it can be determined why it does not have a password: # passwd -l <username> Also, check to see if the account is logged in and investigate what it is being used for to determine if it needs to be forced off.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target ros