UCF STIG Viewer Logo

The /etc/passwd file must not contain password hashes.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22347 GEN001470 SV-26467r1_rule ECLP-1 Medium
Description
If password hashes are readable by non-administrators, the passwords are subject to attack through lookup tables or cryptographic weaknesses in the hashes.
STIG Date
SOLARIS 9 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE 2015-10-01

Details

Check Text ( C-27531r1_chk )
Verify no password hashes are present in /etc/passwd.
# cut -d : -f 2 /etc/passwd | grep -v '^x$'
If any password hashes are returned, this is a finding.
Fix Text (F-23657r1_fix)
Migrate /etc/passwd password hashes to /etc/shadow.
# pwconv