Keep the shadow group empty

Description

/etc/shadow is readable by the shadow group so that a few setgid programs (such as unix_chkpwd) can check passwords. No user needs to be a member of this group.

Rationale

A user in the shadow group can copy every password hash and crack them offline.

Impact

None for a standard system.

Audit

1. getent group shadow shows no member after the last colon.
2. awk -F: -v g="$(getent group shadow | cut -d: -f3)" '$4 == g' /etc/passwd prints nothing.

Automated: every check must pass. Scanners report each check by its id.

members

script: |
  g=$(getent group shadow) || { echo "no shadow group"; exit 0; }
  gid=$(printf '%s' "$g" | cut -d: -f3)
  m=${g##*:}
  p=$(awk -F: -v g="$gid" '$4 == g {print $1}' /etc/passwd | tr '\n' ' ')
  echo "members: ${m:-none}; primary group of: ${p:-none}"
  [ -z "$m$p" ]

Remediation

Remove each member with gpasswd -d <user> shadow, and give users whose primary group is shadow another primary group with usermod -g <group> <user>.

remove-members

cb_backup /etc/group
cb_backup /etc/gshadow
m=$(getent group shadow | cut -d: -f4)
for u in $(printf '%s' "$m" | tr ',' ' '); do gpasswd -d "$u" shadow >/dev/null; done

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• shadow(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle