6.1.3 Ensure permissions on /etc/shadow are configured (Scored) [SecScan]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

======6.1.3 Ensure permissions on /etc/shadow are configured (Scored)======
=====Profile Applicability=====  
<code>
Level 1 - Server
Level 1 - Workstation 
</code>

=====Description=====
The ''/etc/shadow'' file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information.

=====Rationale=====
If attackers can gain read access to the ''/etc/shadow'' file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the ''/etc/shadow'' file (such as expiration) could also be useful to subvert the user accounts.

=====Audit===== 
Run the following command and verify ''Uid'' is ''0/root'', ''Gid'' is ''<gid>/shadow'', and ''Access'' is ''640'' or more restrictive:
<Code:bash>
# stat /etc/shadow 
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)
</Code>
=====Remediation===== 
Run the following command to set permissions on ''/etc/shadow'':
<Code:bash>
# chown root:shadow /etc/shadow 
# chmod o-rwx,g-wx /etc/shadow
</Code>