Store every password hash in shadow and leave no account without a password

Description

/etc/passwd is world-readable and must only contain x in the password field; the hashes belong in /etc/shadow, readable by root and the shadow group only. In /etc/shadow, each password field holds a hash, or !/* for locked accounts, but is never empty.

Rationale

A hash left in /etc/passwd can be copied and cracked by any local user. An empty password field lets anyone log in to the account where empty passwords are accepted.

Impact

None for a standard system.

Audit

1. awk -F: '$2 != "x"' /etc/passwd prints nothing.
2. awk -F: '$2 == ""' /etc/shadow prints nothing.

Automated: every check must pass. Scanners report each check by its id.

shadowed

script: |
  u=$(awk -F: '$2 != "x" {print $1}' /etc/passwd | tr '\n' ' ')
  echo "not shadowed: ${u:-none}"
  [ -z "$u" ]

not-empty

script: |
  u=$(awk -F: '$2 == "" {print $1}' /etc/shadow | tr '\n' ' ')
  echo "empty password: ${u:-none}"
  [ -z "$u" ]

Remediation

1. Run pwconv to move any hash from /etc/passwd to /etc/shadow.
2. Lock each account with an empty password (passwd -l <user>) or give it one (passwd <user>).

Rollback

Restore /etc/passwd and /etc/shadow from the backup.

fix

cb_backup /etc/passwd
cb_backup /etc/shadow
pwconv
for u in $(awk -F: '$2 == "" {print $1}' /etc/shadow); do passwd -l "$u" >/dev/null; done

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• shadow(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R68) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle