Hi!

As a naif new security system master,
I though that setting "hard to find" admin's users names and random UID
would be a good mean to harden server access.

The above make no sens if an attacker that gets access to ordinary (non-admin) account
is allowed to read /etc/passwd file.

The issue is that setting 600 permissions for /etc/passwd has serious drawback :


Is there some way to better that ?

Thanks.

No. The /etc/passwd file is what maps numeric UIDs to user names, and quite a few commands ("ls -l" being the leading example) will not function properly unless /etc/passwd is globally readable. Also, using something other than "root" as the super user's uname will cause a few programs and procedures to misbehave.

But, it's your system, so feel free to break it experiment with it as many ways as you like.

2 members found this post helpful.

I was just checking for other "classic" config to hide admin's info in case of intrusion.

Setting up my own config to overcome this trouble overwhelm my actual knowledge.

Thanks for quick and kind reply.

It's trivial to browse around and find other users (ls /home) and processes. Password hashes are stored in /etc/shadow, which is 600 permissions.

In modern Unix/Linux systems, the /etc/passwd file is required as a mapping of "uid" values to "user names," just as /etc/groups is used for "gids."

But, these files are no longer part of the actual security system. The "password" field is no longer populated, nor used. There are no secrets here.

In the simplest case, "shadow passwords" are stored in a directory that no one but root can read. But there are other authentication possibilities, including full "LDAP/OpenDirectory" participation in a corporate-wide "single sign-on" arrangement.

The underlying Linux technology which enables all of this is quite interesting: "PAM = Programmable Authentication Modules." It is remarkably flexible, and used in many cases, and I encourage you to research how it all works. It's really quite well-done.

Do not attempt to restrict access to /etc/passwd or /etc/groups. You have nothing secret there to hide, and you could break many things.