Monitoring /etc/passwd and /etc/shadow

Fibonacci101 · 09-22-2017, 06:54 AM

Hi

This is my first post ever!

What are the best ways in securing /etc/shadow and /etc/passwd files? and do I really need to monitor anyone who attempts to access these files?

From my understanding it is making sure these file have 600 permissions. User owner and group owner is root. That's about it right?

Reason behind my question is that we have a SIEM solution and the SIEM administrator wants me to push any attempts to /etc/shadow and /etc/passwd to syslog so that he can pick it up on his dashboard.
Although it would be nice to have but surely it is a waste of time?

Thanks for taking time reading my post.

TenTenths · 09-22-2017, 06:58 AM

Quote:

Originally Posted by Fibonacci101

Reason behind my question is that we have a SIEM solution and the SIEM administrator wants me to push any attempts to /etc/shadow and /etc/passwd to syslog so that he can pick it up on his dashboard.
Although it would be nice to have but surely it is a waste of time?

Depending on audit standards it may be a requirement to log any attempted access to certain files. Take a look at auditd] as that may provide the capabilities required.

TB0ne · 09-22-2017, 09:10 AM

Quote:

Originally Posted by Fibonacci101

Hi
This is my first post ever! What are the best ways in securing /etc/shadow and /etc/passwd files? and do I really need to monitor anyone who attempts to access these files?

From my understanding it is making sure these file have 600 permissions. User owner and group owner is root. That's about it right?

Reason behind my question is that we have a SIEM solution and the SIEM administrator wants me to push any attempts to /etc/shadow and /etc/passwd to syslog so that he can pick it up on his dashboard. Although it would be nice to have but surely it is a waste of time?

Thanks for taking time reading my post.

Thankfully, its someone elses time to waste monitoring things that are useless in this case.

https://isc.sans.edu/forums/diary/Au...+friend/15163/

You don't say what SIEM solution, but there are some that can pick up auditd stuff.

!!! · 09-22-2017, 02:52 PM

Hi & "welcome to LQ"

Yes (time waste): there's lots of reasons to read /etc/passwd
Even beginner examples suggest that!!! (A n00b might even innocently >it)

Yes, web-searching is best, in life skills in general too.

I'd suggest an IntroForum post, to tell us about your Linux experience, interests, goals, PC/distro,
for a friendly "hello". But don't tell us the name of the Co.: everyone will 'short' their stock, with all the talk these days about:
https://en.wikipedia.org/wiki/Securi...ent_management

justmy2cents · 09-24-2017, 12:31 AM

Make sure the passwords are MD5 and that theres no duplicate 0 UID (root) entries, and also make sure there's no accounts without a passphrase set.

seraniz · 02-16-2019, 01:22 PM

Quote:

Originally Posted by Fibonacci101

Hi

This is my first post ever!

What are the best ways in securing /etc/shadow and /etc/passwd files? and do I really need to monitor anyone who attempts to access these files?
From my understanding it is making sure these file have 600 permissions. User owner and group owner is root. That's about it right?

Reason behind my question is that we have a SIEM solution and the SIEM administrator wants me to push any attempts to /etc/shadow and /etc/passwd to syslog so that he can pick it up on his dashboard.

Quote:

Originally Posted by Fibonacci101

Although it would be nice to have but surely it is a waste of time?

Thanks for taking time reading my post.

Make sure the passwords are MD5 and that theres no duplicate 0 UID (root) entries, and also make sure there's no accounts without a passphrase set.

TB0ne · 02-17-2019, 09:43 AM

Quote:

Originally Posted by seraniz

[U] Make sure the passwords are MD5 and that theres no duplicate 0 UID (root) entries, and also make sure there's no accounts without a passphrase set.

There a reason you just copied/pasted someone elses answer? Or why you reopened a thread from TWO YEARS AGO? Post reported as spam account, since your other two posts follow the same pattern.

ehartman · 02-17-2019, 10:09 AM

Quote:

Originally Posted by Fibonacci101

From my understanding it is making sure these file have 600 permissions.

/etc passwd needs READ access for all (644), so:
-rw-r--r-- 1 root root <size> <date/time> /etc/passwd
as all kinds of programs need to be able to read it to determine the user NAME from the User ID (UID). If it's not readable no user names can be given by any non-root program.

/etc/shadow needs to readable by the group shadow (640 with group shadow), so:
-rw-r----- 1 root shadow <size> <date/time> /etc/shadow

so neither should have 600 permissions.

BTW: the same goes for /etc/group (644) and /etc/gshadow (640, group shadow) although I haven't seen many non-corporate machines that actual use group shadow passwords.

ehartman · 02-17-2019, 10:20 AM

Quote:

Originally Posted by seraniz

[U] Make sure the passwords are MD5

Nowadays there are alternatives to MD5 encryption for passwords:

Code:

The glibc version of this function supports additional encryption algorithms.

   If salt is a character string starting with the characters "$id$" followed by a
   string optionally terminated by "$", then the result has the form:

       $id$salt$encrypted

   id  identifies the encryption method used instead of DES and this then determines
   how the rest of the password string is interpreted.  The following values of id
   are supported:

              ID  | Method
              ─────────────────────────────────────────────────────────
              1   | MD5
              2a  | Blowfish (not in mainline glibc; added in some
                  | Linux distributions)
              5   | SHA-256 (since glibc 2.7)
              6   | SHA-512 (since glibc 2.7)

(from the manpage "man 3 crypt"), so there can be different encryptions IN your /etc/shadow file.