Ensure permissions on /etc/master.passwd are configured

MediumLevel 1Automatedfreebsd

Description

The /etc/master.passwd file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information. If attackers can gain read access to the /etc/master.passwd file, they can easily run a password cracking program against the hashed password to break it. Audit: /etc/master.passwd must be mode 0000 and owned by root:wheel, as stated by CIS.

How it is checked

Audit method: Shell command

shell

r=compliant; for f in /etc/master.passwd; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='---------' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to set mode, owner, and group on /etc/master.passwd: # chown root:wheel /etc/master.passwd # chmod 0000 /etc/master.passwd

Properties

Operating systems: Any
Tags: freebsdpermissions
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 6.1.3 Ensure permissions on /etc/master.passwd are configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd