Ensure shadow group is empty

中等級 1人工審核cos

說明

The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group. Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert additional user accounts.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run the following commands and verify no results are returned: # grep ^shadow:[^:]*:[^:]*:[^:]+ /etc/group # awk -F: '($4 == "<shadow-gid>") { print }' /etc/passwd

修補方式

修補方法: 操作指南或基礎設施修補檔

Remove all users from the shadow group, and change the primary group of any users with shadow as their primary group.

屬性

作業系統: 不限
標籤: container-optimized-oscos
參考資料: CIS Google Container-Optimized OS Benchmark v1.2.0 - 6.2.20 Ensure shadow group is empty