documentation_complete: true

title: 'Verify All Account Password Hashes are Shadowed'

description: |-
    If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
    instead of an <tt>x</tt>), the cause of this misconfiguration should be
    investigated.  The account should have its password reset and the hash should be
    properly stored, or the account should be deleted entirely.

rationale: |-
    The hashes for all user account passwords should be stored in
    the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
    which is readable by all users.

severity: medium

identifiers:
    cce: 26476-2

references:
    disa: 201
    nist: IA-5(h)
    pcidss: Req-8.2.1
    srg: SRG-OS-999999
    stigid: RHEL-06-000031

ocil_clause: 'any stored hashes are found in /etc/passwd'

ocil: |-
    To check that no password hashes are stored in
    <tt>/etc/passwd</tt>, run the following command:
    <pre>$ awk -F: '($2 != "x") {print}' /etc/passwd</pre>
    If it produces any output, then a password hash is
    stored in <tt>/etc/passwd</tt>.
